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Abstract 

Belief  change  is  a  fundamental  problem  in  AI:  Agents  constantly  have  to  update 
their  beliefs  to  accommodate  new  observations.  In  recent  years,  there  has  been 
much  work  on  axiomatic  characterizations  of  belief  change.  We  claim  that  a  better 
understanding  of  belief  change  can  be  gained  from  examining  appropriate  semantic 
models.  In  this  paper  we  propose  a  general  framework  in  which  to  model  belief 
change.  We  begin  by  defining  belief  in  terms  of  knowledge  and  plausibility:  an  agent 
believes  (j)  if  he  knows  that  (j)  is  more  plausible  than  ^cj).  We  then  consider  some 
properties  defining  the  interaction  between  knowledge  and  plausibility,  and  show 
how  these  properties  affect  the  properties  of  belief.  In  particular,  we  show  that 
by  assuming  two  of  the  most  natural  properties,  belief  becomes  a  KD45  operator. 
Finally,  we  add  time  to  the  picture.  This  gives  us  a  framework  in  which  we  can 
talk  about  knowledge,  plausibility  (and  hence  belief),  and  time,  which  extends  the 
framework  of  Halpern  and  Fagin  for  modeling  knowledge  in  multi-agent  systems. 
We  then  examine  the  problem  of  “minimal  change” .  This  notion  can  be  captured  by 
using  prior  plausibilities,  an  analogue  to  prior  probabilities,  which  can  be  updated 
by  “conditioning” .  We  show  by  example  that  conditioning  on  a  plausibility  measure 
can  capture  many  scenarios  of  interest.  In  a  companion  paper,  we  show  how  the  two 
best-studied  scenarios  of  belief  change,  belief  revision  and  belief  update,  fit  into  our 
framework. 
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by  NSF  under  grants  IRI-95-03109  and  IRI-96-25901.  A  preliminary  version  of  this  paper  appears 


Preprint  submitted  to  Elsevier  Preprint 


7  February  2008 


1  Introduction 


In  order  to  act  in  the  world  we  must  make  assumptions,  such  as  “the  corridor  is  clear”  or 
“my  car  is  parked  where  I  left  it” .  These  assumptions,  however,  are  defeasible.  We  can  easily 
imagine  situations  where  the  corridor  is  blocked,  or  where  the  car  is  stolen.  We  call  the 
logical  consequences  of  such  defeasible  assumptions  beliefs.  As  time  passes,  we  constantly 
obtain  new  information  that  might  cause  us  to  make  additional  assumptions  or  withdraw 
some  of  our  previous  assumptions.  The  problem  of  belief  change  is  to  understand  how  beliefs 
should  change. 

The  study  of  belief  change  has  been  an  active  area  in  philosophy  and  in  artihcial  intelli¬ 
gence  [Gar88,KM91a].  In  the  literature,  two  instances  of  this  general  phenomenon  have  been 
studied  in  detail:  Belief  revision  [AGM85,Gar88]  attempts  to  describe  how  an  agent  should 
accommodate  a  new  belief  (possibly  inconsistent  with  his  other  beliefs)  about  a  static  world. 
Belief  update  [KM91a],  on  the  other  hand,  attempts  to  describe  how  an  agent  should  change 
his  beliefs  as  a  result  of  learning  about  a  change  in  the  world.  Belief  revision  and  belief  update 
describe  only  two  of  the  many  ways  in  which  beliefs  can  change.  Our  goal  is  to  construct  a 
framework  to  reason  about  belief  change  in  general.  This  paper  describes  the  details  of  that 
framework.  In  a  companion  paper  [FH97a]  we  consider  the  special  cases  of  belief  revision 
and  update  in  more  detail. 

Perhaps  the  most  straightforward  approach  to  belief  change  is  to  simply  represent  an  agent’s 
beliefs  as  a  closed  set  of  formulas  in  some  language  and  then  put  constraints  on  how  these 
beliefs  can  change.  This  is  essentially  the  approach  taken  in  [AGM85,Gar88,KM91a];  as  their 
results  show,  much  can  be  done  with  this  framework.  The  main  problem  with  this  approach 
is  that  it  does  not  provide  a  good  semantics  for  belief.  As  we  hope  to  show  in  this  paper 
and  in  [FII97a],  such  a  semantics  can  give  us  a  much  deeper  understanding  of  how  and  why 
beliefs  change.  Moreover,  this  semantics  provides  the  tools  to  deal  with  complicating  factors 
such  actions,  external  events,  and  multiple  agents. 

One  standard  approach  to  giving  semantics  to  beliefs  is  to  put  a  preference  ordering  on 
the  set  of  worlds  that  the  agent  considers  possible.  Intuitively,  such  an  ordering  captures 
the  relative  likelihood  of  worlds.  Various  authors  [Bou92,GP92,KM91a,Spo88]  have  then 
interpreted  “the  agent  believes  0”  as  “0  is  true  in  the  most  plausible  worlds  that  the  agent 
considers  possible”.  An  alternative  approach  is  to  put  a  probability  measure  over  the  set 
of  possible  worlds.  Then  we  can  interpret  “the  agent  believes  0”  as  “the  probability  of  0  is 
close  to  1”  [Pea89].  We  examine  a  new  approach  to  modeling  uncertainty  based  on  plausibility 
measures,  introduced  in  [FH95,FH97b],  where  a  plausibility  measure  just  associates  with  an 
event  (i.e.,  a  set  of  possible  worlds)  its  plausibility,  an  element  in  some  partially  ordered  set. 
This  approach  is  easily  seen  to  generalize  other  approaches  to  modeling  uncertainty,  such 


in  Proceedings  of  the  5th  Conference  on  Theoretieal  Aspeets  of  Reasoning  About  Knowledge,  1994, 
pp.  44-64,  under  the  title  “A  knowledge-based  framework  for  belief  change.  Part  I:  Foundations”. 
This  version  is  almost  identical  to  one  that  will  appear  in  Artifieial  Intelligence. 
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as  probability  measures,  belief  functions,  and  preference  orderings.  We  interpret  the  “agent 
believes  0”  as  “the  plausibility  of  0  is  greater  than  that  of  “10”.  As  we  show,  this  is  often 
(but  not  always)  equivalent  to  “0  is  true  in  the  most  plausible  worlds” . 

By  modeling  beliefs  in  this  way,  there  is  an  assumption  that  the  plausibility  measure  is  part  of 
the  agent’s  epistemic  state.  (This  assumption  is  actually  made  explicitly  in  [Bou92,KLM90].) 
This  implies  that  the  plausibility  measure  is  subjective,  that  is,  it  describes  the  agent’s 
estimate  of  the  plausibility  of  each  event.  But  actually,  an  even  stronger  assumption  is 
being  made:  namely,  that  the  agent’s  epistemic  state  is  characterized  by  a  single  plausibility 
measure.  We  feel  that  this  latter  assumption  makes  the  models  less  expressive  than  they 
ought  to  be.  In  particular,  they  cannot  represent  a  situation  where  the  agent  is  not  sure 
about  what  is  plausible,  such  as  “Alice  does  not  know  that  it  typically  does  not  rain  in 
San  Francisco  in  the  summer”.  To  capture  this,  we  need  to  allow  Alice  to  consider  several 
plausibility  measures  possible;  in  some  it  typically  does  not  rain  and  in  others  it  typically 
does.  ^  As  we  shall  see,  this  extra  expressive  power  is  necessary  to  capture  some  interesting 
scenarios  of  belief  change. 

To  deal  with  this,  in  addition  to  plausibility  measures,  we  add  a  standard  accessibility  relation 
to  represent  knowledge.  Once  we  have  knowledge  in  the  picture,  we  dehne  belief  by  saying 
that  an  agent  believes  0  if  she  knows  that  0  is  typically  true.  That  is,  according  to  all  the 
plausibility  measures  she  considers  possible,  0  is  more  plausible  than  -i0. 

The  properties  of  belief  depend  on  how  the  plausibility  measure  interacts  with  the  acces¬ 
sibility  relation  that  dehnes  knowledge.  We  study  these  interactions,  keeping  in  mind  that 
plausibility  generalizes  probability.  In  view  of  this,  it  is  perhaps  not  surprising  that  many 
of  the  issues  studied  by  Fagin  and  Halpern  [FH94a]  when  considering  the  interaction  of 
knowledge  and  probability  also  arise  in  our  framework.  There  are,  however,  a  number  of  new 
issues  that  arise  in  our  framework  due  to  the  interaction  between  knowledge  and  belief.  As 
we  shall  see,  if  we  take  what  are  perhaps  the  most  natural  restrictions  on  this  interaction,  our 
notion  of  belief  is  characterized  by  the  axioms  of  the  modal  logic  KD45  (where  an  agent  has 
complete  introspective  knowledge  about  her  beliefs,  but  may  have  false  beliefs).  Moreover, 
the  interaction  between  knowledge  and  belief  satishes  the  standard  properties  considered 
by  Kraus  and  Lehmann  [KL88].  Although  our  major  goal  is  not  an  abstract  study  of  the 
properties  of  knowledge  and  belief,  we  view  the  fact  that  we  have  a  concrete  interpretation 
under  which  these  properties  can  be  studied  to  be  an  important  side-beneht  of  our  approach. 

Having  a  notion  of  belief  is  not  enough  in  order  to  study  belief  change.  We  want  a  framework 
that  captures  the  beliefs  of  the  agent  before  and  after  the  change.  This  is  achieved  by 
introducing  time  explicitly  into  the  framework.  The  resulting  framework  is  an  extension  of 
the  framework  of  Halpern  and  Fagin  [HF89]  for  modeling  knowledge  in  multi-agent  systems, 
and  allows  to  talk  about  knowledge,  plausibility  (and  hence  belief),  and  time.  This  framework 
is  analogous  to  combination  of  knowledge,  probability  and  time  studied  in  [HT93].  As  we 


^  In  fact,  this  issue  is  discussed  by  Boutilier  [Bou92],  although  his  framework  does  not  allow  him 
to  represent  such  a  situation. 
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show  by  example,  having  knowledge,  plausibility,  and  time  represented  explicitly  gives  us  a 
powerful  and  expressive  framework  for  capturing  belief  change. 


This  framework  is  particularly  suited  to  studying  how  plausibility  changes  over  time.  One 
important  intuition  we  would  like  to  capture  is  that  of  minimal  change.  Suppose  an  agent 
gets  new  information  at  time  t.  Certainly  we  would  expect  his  plausibility  assessment  (and 
his  beliefs)  at  time  t  + 1  to  incorporate  this  new  information;  otherwise,  we  would  expect  his 
assessment  at  time  t  +  1  to  have  changed  minimally  from  his  assessment  at  time  t.  In  prob¬ 
abilistic  reasoning,  it  can  be  argued  that  conditioning  captures  this  intuition.  Conditioning 
incorporates  the  new  information  by  giving  it  probability  1.  Moreover,  the  relative  probability 
of  all  events  consistent  with  the  new  information  is  the  same  before  and  after  conditioning, 
so,  in  this  sense,  conditioning  changes  things  minimally.  We  focus  here  on  a  plausibilistic 
analogue  of  conditioning  and  argue  that  it  captures  the  intuition  of  minimal  change  in  plau¬ 
sibilities.  We  can  then  proceed  much  in  the  spirit  of  the  Bayesian  approach,  but  starting  with 
a  prior  plausibility  and  conditioning.  As  we  show,  many  situations  previously  studied  in  the 
literature,  such  as  diagnostic  reasoning  [Rei87],  can  be  easily  captured  by  using  such  prior 
plausibilities.  Moreover,  as  we  show  in  a  companion  paper  [FH97a],  belief  revision  and  belief 
update — which  both  attempt  to  capture  intuitions  involving  minimal  change  in  beliefs — can 
be  captured  in  our  framework  by  conditioning  on  an  appropriate  prior  plausibility  measure. 
Thinking  in  terms  of  priors  also  gives  us  insight  into  other  representations  of  belief  change, 
such  as  those  of  [Bou94b,GP92,LS94]. 

The  rest  of  this  paper  is  organized  as  follows.  In  the  next  section,  we  review  the  syntax  and 
semantics  of  the  standard  approach  to  modeling  knowledge  using  Kripke  structures  and  show 
how  plausibility  can  be  added  to  the  framework.  Much  of  our  technical  discussion  of  axiom- 
atizations  and  decision  procedures  is  closely  related  to  that  of  [FH94a].  In  Section  3.1,  we 
present  our  full  framework  which  adds  plausibility  to  the  framework  of  [HF89]  for  modeling 
knowledge  (and  time)  in  multi-agent  systems.  In  Section  4  we  introduce  prior  plausibilities 
and  show  how  they  can  be  used.  We  conclude  in  Section  5  with  some  discussion  of  the  general 
approach.  Proofs  of  theorems  are  given  in  Appendix  A. 


2  Knowledge  and  Plausibility 


In  this  section,  we  briefly  review  the  standard  models  for  knowledge  and  beliefs  (see  [HM92] 
for  further  motivation  and  details),  describe  a  notion  of  plausibility,  and  then  show  how  to 
combine  the  two  notions.  Finally,  we  compare  the  derived  notion  of  belief  with  previous  work 
on  the  subject. 
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2.1  The  Logic  of  Knowledge 


We  start  by  examining  the  standard  models  for  knowledge  and  belief.  The  syntax  for  the  logic 
of  knowledge  is  simple:  we  start  with  primitive  propositions  and  close  off  under  conjunction, 
negation,  and  the  modal  operators  i^i, . . . ,  Kn-  A  formula  such  as  Kicj)  is  read  “agent  i  knows 
0”.  The  logic  of  belief  is  the  result  of  replacing  the  Ki  operator  by  Bi.  The  formula,  BiCp  is 
read  “agent  i  believes  0”.  The  resulting  languages  are  denoted  and  ,  respectively. 

The  semantics  for  these  languages  is  given  by  means  of  Kripke  structures.  A  Kripke  structure 
for  knowledge  (or  belief)  is  a  tuple  (lT,7r,/Ci, . . .  ,/C„),  where  hh  is  a  set  of  possible  worlds, 
7i{w)  is  a  truth  assignment  to  the  primitive  propositions  at  world  w  G  W,  and  the  ICfs  are 
accessibility  relations  on  the  worlds  in  W.  For  convenience,  we  dehne  K,i{w)  =  {w'  :  {w,  w')  G 
Ki}.  Intuitively,  Ki{w)  describes  the  set  of  worlds  that  agent  i  considers  possible  in  w.  We 
say  that  agent  i  knows  (or  believes)  0  at  world  w,  if  all  the  worlds  Ki{w)  satisfy  0. 

We  assign  truth  values  to  formulas  at  each  world  in  the  structure.  We  write  (M,  tc)  |=  0  if 
the  formula  0  is  true  at  a  world  w  in  the  Kripke  structure  M. 

•  (M,  w)  \=  p  for  a  primitive  proposition  p  if  n{w){p)  =  true, 

•  (M,  w)  \=  -10  if  (M,  w)  ^  0, 

•  (M,  w)  1=  0  A  0  if  (M,  w)  \=  (j)  and  (M,  w)  \=  0, 

•  {M,w)  \=  Ki(j)  if  {M,w')  1=  0  for  all  w'  G  Ki{w). 

The  last  clause  captures  the  intuition  that  0  is  known  exactly  when  it  is  true  in  all  possible 
worlds.  When  considering  the  language  of  beliefs  ,  we  typically  use  Bi  rather  than  Ki  to 
denote  the  accessibility  relations.  The  truth  condition  for  5^0  is  exactly  the  same  as  for  Kicj). 

Let  M-k  be  the  class  of  Kripke  structures  described  above.  We  say  that  0  G  is  valid 
in  some  M  G  M.k  if  {M,w)  \=  0  for  all  w  in  M.  We  say  that  0  G  is  valid  in  Aix  if 
it  is  valid  in  all  models  M  G  M.k-  We  say  that  0  is  satisfiable  in  M.k  if  there  is  a  model 
M  G  M-k  and  world  w  such  that  (M,  w)  |=  0. 

The  dehnition  of  Kripke  structure  does  not  put  any  restriction  on  the  Ki  relations.  By 
imposing  conditions  on  the  Ki  relations  we  get  additional  properties  of  knowledge  (or  belief). 
These  properties  are  captured  by  systems  of  axioms  that  describe  the  valid  formulas  in  classes 
of  structures  that  satisfy  various  constraints  of  interest.  We  briefly  describe  these  systems  and 
the  corresponding  constraints  on  the  accessibility  relations.  Consider  the  following  axioms 
and  rules: 

KI.  All  substitution  instances  of  propositional  tautologies 
K2.  Ki(P  A  Ki{(t)  ^  0)  ^  Kifj 
K3.  Ki(j)  0 
K4.  K,0  ^  K,K4 
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K5.  ~^Ki(()  ^  Ki^Kicj) 

K6.  -^Kifalse 

RKl.  From  0  and  (j)  ^  ip  infer  ip 
RK2.  From  (p  infer  Ki(p 

The  system  K  contains  the  axioms  K1  and  K2  and  the  rules  of  inference  RKl  and  RK2.  By 
adding  axioms  K4  and  K5  we  get  system  K45;  if  in  addition  we  add  axiom  K6  we  get  system 
KD45;  if  instead  we  add  axiom  K3  to  K45  we  get  the  axiom  system  known  as  S5. 

We  now  relate  these  axiom  systems  with  restrictions  on  the  accessibility  relations.  We  start 
with  some  dehnitions.  A  relation  IZ  on  W  is  Euclidean  if  {x,y),  {x,  z)  G  IZ  implies  that 
(y,  z)  G  7Z,  for  all  x,  y  and  2:  in  IF;  it  is  reflexive  if  {x,  x)  G  7Z  for  all  a;  G  IF;  it  is  serial  if  for 
all  a;  G  IF  there  is  ay  such  that  (a;,  y)  G  R]  and  it  is  transitive  if  (a;,  y) ,  (y,  z)  eTZ  implies  that 
(a;,  z)  G  7Z,  for  x,  y  and  2  in  IF.  Let  Af  be  the  set  of  Kripke  structures  with  Euclidean  and 
transitive  accessibility  relations,  be  the  subset  of  where  the  accessibility  relations 
are  also  serial,  and  be  the  subset  of  where  the  accessibility  relations  are  also 

transitive. 

Theorem  1  [HM92]  The  axiom  system  K  (resp.  K45,  KD45,  S5)  is  a  sound  and  complete 
axiomatization  of  with  respect  to  M.k  (resp.  Aipp, 

In  this  paper,  we  use  the  multi-agent  systems  formalism  of  [FHMV95]  to  model  knowledge; 
this  means  that  knowledge  satishes  the  axioms  of  S5.  (We  provide  some  motivation  for  this 
choice  below;  see  [FHMV95]  for  further  discussion.) 

This  implies  that  if  an  agent  knows  0,  then  cp  is  true  (K3)  and  that  the  agent  is  introspective — 
he  knows  what  he  knows  and  does  not  know  (K4  and  K5).  Belief,  on  the  other  hand,  is 
typically  viewed  as  defeasible.  Thus,  it  does  not  necessarily  satisfy  K3.  It  may  satisfy  a  weaker 
property,  such  as  K6,  which  says  that  the  agent  does  not  believe  inconsistent  formulas.  Like 
knowledge,  belief  is  taken  to  be  introspective,  as  it  satishes  K4  and  K5.  Thus,  in  the  literature, 
belief  has  typically  been  take  to  satisfy  K45  or  KD45;  we  do  the  same  here.  According  to 
Theorem  1,  this  means  that  the  notion  of  knowledge  we  use  is  characterized  by  Af^*  while 
belief  is  characterized  by  Ai'fp  or 


2.2  Plausibility  Measures 


Most  non-probabilistic  approaches  to  belief  change  require  (explicitly  or  implicitly)  that 
the  agent  has  some  ordering  over  possible  alternatives.  For  example,  the  agent  might  have  a 
preference  ordering  over  possible  worlds  [Bou94b,Gro88,KM91b]  or  an  entrenchment  ordering 

^  As  is  well  known,  a  relation  is  reflexive.  Euclidean  and  transitive  if  and  only  if  it  is  an  equivalence 
relation  (i.e.,  reflexive,  symmetric  and  transitive).  Thus,  consists  of  these  structures  where 

the  /Cj’s  are  equivalence  relations. 
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over  formulas  [GM88].  This  ordering  dictates  how  the  agent’s  beliefs  change.  For  example,  in 
[Gro88],  the  new  beliefs  are  characterized  by  the  most  preferred  worlds  that  are  consistent 
with  the  new  observation,  while  in  [GM88]  beliefs  are  discarded  according  to  their  degree  of 
entrenchment  until  it  is  consistent  to  add  the  new  observation  to  the  resulting  set  of  beliefs. 

Keeping  this  insight  in  mind,  we  now  describe  plausibility  measures  [FH95,FH97b].  This  is 
a  notion  for  handling  uncertainty  that  generalizes  previous  approaches,  including  various 
notions  of  preference  ordering.  We  briefly  review  the  relevant  dehnitions  and  results  here. 

Recall  that  a  probability  space  is  a  tuple  (1T,JF,  Pr),  where  IF  is  a  set  of  worlds,  T  is 
an  algebra  of  measurable  subsets  of  W  (that  is,  a  set  of  subsets  closed  under  union  and 
complementation  to  which  we  assign  probability),  and  Pr  is  a  probability  measure,  that  is,  a 
function  mapping  each  set  in  JF  to  a  number  in  [0, 1]  satisfying  the  well-known  probability 
axioms  (Pr(0)  =  0,  Pr(lF)  =  1,  and  Pr(A  U  B)  =  Pr(yl)  -|-  Pr{B),  if  A  and  B  are  disjoint). 

A  plausibility  space  is  a  direct  generalization  of  a  probability  space.  We  simply  replace  the 
probability  measure  Pr  by  a  plausibility  measure  PI,  which,  rather  than  mapping  sets  in  JF 
to  numbers  in  [0, 1],  maps  them  to  elements  in  some  arbitrary  partially  ordered  set.  We  read 
P1(A)  as  “the  plausibility  of  set  A”.  If  P1(A)  <  Pl(i?),  then  B  is  at  least  as  plausible  as  A. 
Formally,  a  plausibility  spaee  is  a  tuple  S  =  (1F,JF,  PI),  where  hF  is  a  set  of  worlds,  T  is 
an  algebra  of  subsets  of  IV,  and  PI  maps  sets  in  T  to  some  domain  D  of  plausibility  values 
partially  ordered  by  a  relation  <d  (so  that  <d  is  reflexive,  transitive,  and  anti-symmetric). 
We  assume  that  D  is  pointed:  that  is,  it  contains  two  special  elements  T d  and  Vd  such  that 
Vd^d  d  <D  T D  for  all  d  E  D]  we  further  assume  that  Pl(lF)  =  Td  and  P1(0)  =-i-£).  As 
usual,  we  dehne  the  ordering  <£>  by  taking  di  <d  d2  if  di  <d  ^2  and  di  ^  d2-  We  omit  the 
subscript  D  from  <£>,  <£>,  T £,  and  whenever  it  is  clear  from  context. 

Since  we  want  a  set  to  be  at  least  as  plausible  as  any  of  its  subsets,  we  require 

A1  If  A  C  B,  then  P1(A)  <  P1(R). 

Some  brief  remarks  on  this  dehnition:  We  have  deliberately  suppressed  the  domain  D  of 
plausibility  values  from  the  tuple  S,  since  for  the  purposes  of  this  paper,  only  the  ordering 
induced  by  <  on  the  subsets  in  T  is  relevant.  The  algebra  JF  also  does  not  play  a  signihcant 
role  in  this  paper.  Unless  we  say  otherwise,  we  assume  T  contains  all  subsets  of  interest  and 
suppress  mention  of  T ,  denoting  a  plausibility  space  as  a  pair  {W,  PI) . 

Glearly  plausibility  spaces  generalize  probability  spaces.  We  now  briefly  discuss  a  few  other 
notions  of  uncertainty  that  they  generalize: 

•  A  belief  funetion  R  on  hF  is  a  function  B  :  2^  — [0, 1]  satisfying  certain  axioms  [Sha76]. 
These  axioms  certainly  imply  property  Al,  so  a  belief  function  is  a  plausibility  measure. 

•  A  fuzzy  measure  (or  a  Sugeno  measure)  f  on  W  [WK92]  is  a  function  /  :  2^  i— >•  [0, 1], 
that  satishes  Al  and  some  continuity  constraints.  A  possibility  measure  [DP90]  Poss  is  a 
fuzzy  measure  such  that  Poss(hF)  =  1,  Poss(0)  =  0,  and  Poss(A)  =  sup^g^(Poss({tc}). 

•  An  ordinal  ranking  (or  n-ranking)  on  W  (as  dehned  by  [GP92],  based  on  ideas  that  go 
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back  to  [Spo88])  is  a  function  k  :  2^  IN*,  where  IN*  =  IV  U  {cxd},  such  that  k{W)  =  0, 
fi;(0)  =  cx),  and  k{A)  =  min^g^(fi;({t(;})).  Intuitively,  an  ordinal  ranking  assigns  a  degree 
of  surprise  to  each  subset  of  worlds  in  W ,  where  0  means  unsurprising  and  higher  numbers 
denote  greater  surprise.  It  is  easy  to  see  that  if  k  is  a  ranking  on  W ,  then  {W,  k)  is  a 
plausibility  space,  where  x  y  if  and  only  \i  y  <  x  under  the  usual  ordering  on  the 

ordinals. 

•  A  preference  ordering  on  hh  is  a  partial  order  -<  over  W  [KLM90,Sho87].  Intuitively,  w  -<  w' 
holds  if  w  is  preferred  to  w'.  Preference  orders  have  been  used  to  provide  semantics  for 
default  (i.e.,  conditional)  statements.  In  [FH97b]  we  show  how  to  map  preference  orders 
on  W  to  plausibility  measures  on  hP  in  a  way  that  preserves  the  ordering  of  events  of  the 
form  {tc}  as  well  as  the  truth  values  of  defaults.  We  review  these  results  below. 

•  A  parametrized  probability  distribution  (PPD)  on  hP  is  a  sequence  {Pr*  :  i  >  0}  of 
probability  measures  over  W.  Such  structures  provide  semantics  for  defaults  in  e-semanties 
[Pea89,GMP93].  In  [FII97b]  we  show  how  to  map  PPDs  into  plausibility  structures  in  a 
way  that  preserves  the  truth- values  of  conditionals  (again,  see  discussion  below). 


2.3  The  Logie  of  Conditionals 


Our  goal  is  to  describe  the  agent’s  beliefs  in  terms  of  plausibility.  To  do  this,  we  describe 
how  to  evaluate  statements  of  the  form  Bcf)  given  a  plausibility  space.  In  fact,  we  examine 
a  richer  logical  language  that  also  allows  us  to  describe  how  the  agent  compares  different 
alternatives.  This  is  the  logic  of  conditionals.  Conditionals  are  statements  of  the  form  cf  ^  f), 
read  “given  0,  ip  is  plausible”  or  “given  0,  then  by  default  ip” .  The  syntax  of  the  logic  of 
conditionals  is  simple:  we  start  with  primitive  propositions  and  close  off  under  conjunction, 
negation  and  the  modal  operator  — *>.  The  resulting  language  is  denoted 

Many  semantics  have  been  proposed  in  the  literature  for  conditionals.  Most  of  them  involve 
structures  of  the  form  (hP,  X,  tt),  where  hP  is  a  set  of  possible  worlds,  ti{w)  is  a  truth  as¬ 
signment  to  primitive  propositions,  and  X  is  some  “measure”  on  W  such  as  a  preference 
ordering,  a  ^-ranking,  or  a  possibility  measure.  We  now  describe  some  of  the  proposals  in 
the  literature,  and  then  show  how  they  can  be  viewed  as  using  plausibility  measures.  Given 
a  structure  (hP,  X,  tt),  let  [0]  C  hP  be  the  set  of  worlds  satisfying  0. 

•  A  possibility  structure  is  a  tuple  (hP,  Poss,  tt),  where  Poss  is  a  possibility  measure  on  W. 
It  satishes  a  conditional  0  — >  0  if  either  Poss([0])  =  0  or  Poss([0  A  0])  >  Poss([0  A  “'0]) 
[DP91].  That  is,  either  0  is  impossible,  in  which  case  the  conditional  holds  vacuously,  or 
0  A  0  is  more  possible  than  0  A  ->0. 

•  A  K-structure  is  a  tuple  {W,n,Ti),  where  n  is  an  ordinal  ranking  on  W.  It  satishes  a 
conditional  0  — >•  0  if  either  k([0])  =  cxd  or  /t;([0  A  0])  <  k([0  A  “10])  [GP92]. 

•  A  preferential  structure  is  a  tuple  (hP,  tt),  where  -<  is  a  partial  order  on  W.  The  intuition 
[Sho87]  is  that  a  preferential  structure  satishes  a  conditional  0  — >■  0  if  all  the  most  preferred 
worlds  (i.e.,  the  minimal  worlds  according  to  -<)  in  [0]  satisfy  ip.  However,  there  may  be 
no  minimal  worlds  in  [0].  This  can  happen  if  [0]  contains  an  inhnite  descending  sequence 


. . .  W2  ~<  wi.  What  do  we  do  in  these  structures?  There  are  a  number  of  options:  the  first 
is  to  assume  that,  for  each  formula  0,  there  are  minimal  worlds  in  [0];  this  is  the  assumption 
actually  made  in  [KLM90],  where  it  is  called  the  smoothness  assumption.  A  yet  more 
general  dehnition — one  that  works  even  if  -<  is  not  smooth — is  given  in  [Lew73,Bou94a]. 
Roughly  speaking,  0  — is  true  if,  from  a  certain  point  on,  whenever  0  is  true,  so  is 
More  formally, 

(IT,  -<,  tt)  satishes  0  — if  for  every  world  wi  G  [0],  there  is  a  world  W2  such  that  (a) 
W2  A  Wi  (so  that  W2  is  at  least  as  normal  as  tci),  (b)  W2  G  [0  A^],  and  (c)  for  all  worlds 
W3  -<  W2,  we  have  tcs  G  [0  ^  0]  (so  any  world  more  normal  than  W2  that  satishes  0 
also  satishes  0). 

It  is  easy  to  verify  that  this  dehnition  is  equivalent  to  the  earlier  one  if  -<  is  smooth. 

•  A  PPD  structure  is  a  tuple  (IT,  {Pr*  :  i  >  0},7r),  where  {Pr*}  is  PPD  over  IT.  Intuitively, 
it  satishes  a  conditional  0  — 0  if  the  conditional  probability  0  given  0  goes  to  1  in  the 
limit.  Formally,  0  — >•  0  is  satished  if  limj^oo  Pf([0]  |  [0])  =  1  [GMP93]  (where  Prj([0]|[0]) 
is  taken  to  be  1  if  Prj([0])  =  0). 

In  [FH97b]  we  use  plausibility  to  provide  semantics  for  conditionals  and  show  that  our 
dehnition  generalizes  the  dehnition  in  the  various  approaches  we  just  described.  We  briehy 
review  the  dehnitions  and  results  here. 

A  plausibility  structure  is  a  tuple  PL  =  (lT,Pl,7r),  where  PI  is  a  plausibility  measure  on  IT. 
Conditionals  are  evaluated  according  to  a  rule  that  is  essentially  that  used  in  possibility 
structures: 

•  PL  1=  0  — >•  0  if  either  P1([0])  =T  or  P1([0  A  0])  >  P1([0  A  -■0]). 

Intuitively,  0  — 0  holds  vacuously  if  0  is  impossible;  otherwise,  it  holds  if  0  A  0  is  more 
plausible  than  0  A  ->0.  It  is  easy  to  see  that  this  semantics  for  conditionals  generalizes 
the  semantics  of  conditionals  in  possibility  structures  and  ^-structures.  The  following  result 
shows  that  it  also  generalizes  the  semantics  of  conditionals  in  preferential  structures  and 
PPD  structures. 

Proposition  2  [FH97b] 

(a)  If  -<  is  a  preference  ordering  on  W ,  then  there  is  a  plausibility  measure  Pl^  on  W  such 
that  (IT,  P,  vr)  |=  0  — >•  0  if  and  only  if  (IT,  Pl_<,  tt)  |=  0  — >  0. 

(b)  If  PP  =  {Pr*}  is  a  PPD  on  W,  then  there  is  a  plausibility  measure  Plpp  such  that 
(IT,  {Prj},  tt)  1=  0  — >  0  i/  and  only  if  (IT,  Plpp,  tt)  |=  0  — >•  0. 

We  briehy  describe  the  construction  of  P0  and  Plpp  here,  since  we  use  them  in  the  sequel. 
Given  a  preference  order  -<  on  IT,  let  Dq  be  the  domain  of  plausibility  values  consisting  of 
one  element  dw  for  every  element  w  G  IT.  We  dehne  a  partial  order  on  Dq  using  -<:  d^  <  dw 
a  w  -<  V.  (Recall  that  w  -<  w'  denotes  that  w  is  preferred  to  w'.)  We  then  take  D  to  be 
the  smallest  set  containing  Dq  that  is  closed  under  least  upper  bounds  (so  that  every  set  of 
elements  in  D  has  a  least  upper  bound  in  D).  For  a  subset  A  of  IT,  we  can  then  dehne  Pl^(A) 
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to  be  the  least  upper  bound  of  {dw  ■.  w  &  A}.  Since  D  is  closed  under  least  upper  bounds, 
Pl^(A)  is  well  defined.  As  shown  in  [FH97b],  this  choice  of  Pl^  satishes  Proposition  2. 

The  construction  in  the  case  of  PPD’s  is  even  more  straightforward.  Given  a  PPD  PP  = 
{Pvi}  on  hP,  we  dehne  Plpp  as  follows: 

Plpp(A)  <  Plpp (5)  if  and  only  if  limj^oo  Pri(-B|A  U  i?)  =  1. 

A  straightforward  argument  shows  that  this  choice  of  Plpp  satishes  Proposition  2. 

These  results  show  that  our  semantics  for  conditionals  in  plausibility  structures  generalizes 
the  various  approaches  examined  in  the  literature.  Does  it  capture  our  intuitions  about 
conditionals?  In  the  AI  literature,  there  has  been  discussion  of  the  right  properties  of  default 
statements  (which  are  essentially  conditionals).  While  there  has  been  little  consensus  on 
what  the  “right”  properties  for  defaults  should  be,  there  has  been  some  consensus  on  a 
reasonable  “core”  of  inference  rnles  for  default  reasoning.  This  core,  known  as  the  KLM 
properties  [KLM90],  consists  of  the  following  axiom  and  rules  of  inference: 

LLE.  From  0-^0'  and  0  — >■  0  infer  0'  — >  0  (left  logical  eqnivalence) 

RW.  From  0  0'  and  0  — >■  0  infer  0  — >  0'  (right  weakening) 

REF.  0  — >  0  (reflexivity) 

AND.  From  0  — >  0i  and  0  — >  02  infer  0  — >■  0i  A  02 
OR.  From  0i  — >  0  and  02  — >■  0  infer  0i  V  02  — >■  0 

CM.  From  0  — >  0i  and  0  — >■  02  infer  0  A  0i  — >  02  (cantious  monotonicity) 

LLE  states  that  the  syntactic  form  of  the  antecedent  is  irrelevant.  Thus,  if  0i  and  02  are 
eqnivalent,  we  can  dednce  02  0  from  0i  — 0.  RW  describes  a  similar  property  of  the 

conseqnent:  If  0  (logically)  entails  0',  then  we  can  dednce  0  — >  0'  from  0  — >■  0.  This  allows  us 
to  can  combine  default  and  logical  reasoning.  REF  states  that  0  is  always  a  default  conclusion 
of  0.  AND  states  that  we  can  combine  two  default  conclusions:  If  we  can  conclnde  by  default 
both  01  and  02  from  0,  we  can  also  conclnde  0i  A  02  from  0.  OR  states  that  we  are  allowed 
to  reason  by  cases:  If  the  same  default  conclusion  follows  from  each  of  two  antecedents,  then 
it  also  follows  from  their  disjnnction.  CM  states  that  if  0i  and  02  are  two  default  conclusions 
of  0,  then  discovering  that  0i  holds  when  0  holds  (as  would  be  expected,  given  the  default) 
should  not  cause  us  to  retract  the  default  conclusion  02. 

Do  conditionals  in  plausibility  structures  satisfy  the  KLM  properties?  In  general,  the  answer 
is  no.  It  is  almost  immediate  from  the  dehnition  that  a  probability  measure  Pr  is  also  a 
plausibility  measure.  Notice  that  Pr([0A0])  >  Pr([0A-'0])  if  and  only  if  Pr([0]  |  [0])  >  1/2. 
Expanding  the  semantics  of  conditionals,  we  get  that  0  — >■  0  holds  in  Pr  exactly  if  Pr([0])  =  0 
or  Pr([0]  I  [0])  >  1/2.  It  is  easy  to  see  that  this  dehnition  does  not  satisfy  the  AND  rule: 
it  is  not  in  general  the  case  that  0  — 0i  and  0  — >  02  together  imply  0  — (0i  A  02),  since 
Pr(Ai  I  B)  >  1/2  and  Pr(A2  I  B)  >  1/2  do  not  imply  Pr(Ai  fl  A2|i?)  >  1/2.  Since  the  AND 
rnle  is  a  fnndamental  featnre  of  qnalitative  reasoning,  we  would  like  to  restrict  to  plausibility 
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structures  where  it  holds.  In  [FH97b]  we  show  that  the  following  condition  is  necessary  and 
sufficient  to  guarantee  that  the  And  rule  holds: 

A2  If  A,  B,  and  C  are  pairwise  disjoint  sets,  Pl(AUi?)  >  P1(C),  and  Pl(AuC)  >  Pl(i?), 

then  P1(A)  >  P1(5UC'). 

It  turns  out  that  conditionals  in  plausibility  structures  that  satisfy  A2  also  satisfy  LLE, 
RW,  and  CM.  They  also  satisfy  OR  when  one  of  the  conditionals  (pi  ^  'ip  and  02  — ^  t/’  is 
satished  non- vacuously  (that  is,  in  a  plausibility  measure  PI  such  that  either  Pl([0i])  >  T 
or  PI ([02])  >  T).  To  satisfy  OR  in  general  we  need  another  condition: 

A3  If  P1(A)  =  P1(R)  =T,  then  P1(A  U  B)  =T. 

A3  also  has  a  nice  axiomatic  characterization.  Let  Np  be  an  abbreviation  for  -i0  — false. 
(This  operator  is  called  the  “outer  modality”  in  [Lew73].)  Expanding  the  dehnition  of  — 
we  get  that  Np  holds  at  w  if  and  only  if  Pl([-i0])  =T.  Thus,  Np  holds  if  ->0  is  considered 
completely  implausible.  We  can  think  of  the  N  modality  as  the  plausibilistic  version  of 
necessity.  It  is  easy  to  show  that  A3  corresponds  to  an  AND  rule  for  N.  It  holds  exactly  if 
(A0  A  A0)  ^  A(0  A0). 

A  plausibility  space  (IT,  PI)  is  qualitative  if  it  satishes  A2  and  A3.  A  plausibility  structure 
(IT,  PI,  tt)  is  qualitative  if  (IT,  PI)  is  a  qualitative  plausibility  space.  In  [FH97b]  we  show  that, 
in  a  very  general  sense,  qualitative  plausibility  structures  capture  default  reasoning.  More 
precisely,  we  show  that  the  KLM  properties  are  sonnd  with  respect  to  a  class  of  plausibility 
structures  if  and  only  if  the  class  consists  of  qnalitative  plansibility  strnctnres.  We  also  show 
that  a  very  weak  condition  is  necessary  and  snfficient  in  order  for  the  KLM  properties  to  be 
complete  axiomatization  of  the  langnage  of  default  entailment  considered  in  [KLM90] .  These 
results  help  explain  why  so  many  different  approaches  to  giving  semantics  to  conditionals 
are  characterized  by  the  KLM  properties.  In  addition,  as  we  shall  see,  it  also  shows  that  if 
we  want  belief  to  have  some  reasonable  properties,  then  we  need  to  restrict  to  qnalitative 
plausibility  measures. 


2-4  Combining  Knowledge  and  Plausibility 


We  now  dehne  a  logic  that  combines  knowledge  and  plausibility.  Let  be  the  language 
obtained  by  starting  with  primitive  propositions,  and  closing  off  nnder  conjnnction,  negation, 
and  the  operators  Ki  and  — i  =  1, . . . ,  n.  Note  that  we  have  a  different  conditional  operator 
for  each  agent.  We  read  p  — p  as  “according  to  agent  i’s  plansibility  measnre,  p  typically 
implies  0”. 

A  (Kripke)  structure  (for  knowledge  and  plausibility)  is  a  tnple  (IT,  tt,  /Ci, . . . ,  /C„,  Vi, . . . ,  Vn) 
where  IT,  tt  and  ICi  are  just  as  in  Kripke  strnctnres  for  knowledge,  while  Vi  is  a  plausibility 
assignment,  a  fnnction  that  assigns  a  plausibility  space  to  agent  i  at  each  world.  Intnitively, 
the  strnctnre  Vi{w)  =  (IT(^^i),  Pl(u,,i))  captnres  agent  i’s  plausibility  measure  in  the  world  w. 
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For  now  we  allow  W(^w,i)  to  be  an  arbitrary  subset  of  W.  We  discuss  some  possible  restrictions 
on  below.  It  is  reasonable  to  ask  at  this  point  where  the  plausibility  spaces  Vi{w)  are 

coming  from,  and  why  we  need  a  different  one  for  each  agent  at  each  world.  The  answer  to 
this  question  depends  very  much  on  the  intended  application.  We  defer  further  discussion  of 
this  issue  until  later. 

We  can  now  give  semantics  to  formulas  in  in  Kripke  structures  for  knowledge  and 
plausibility.  This  is  done  in  a  recursive  way  using  the  rules  specihed  above  for  and 
Statements  of  the  form  Kicj)  are  evaluated  according  to  /Cp 

•  {M,w)  1=  Ki(j)  if  {M,w')  1=  0  for  all  w'  E  ICi{w). 

Statements  of  the  form  0  — tjj  are  evaluated  according  to  Vi.  Let  =  {w'  E  : 

•  (M,w)  1=0  0  if  either  Pl(^,i)([0](^,i))  =_L  or  Pl(^,i)([0A0](^,p)  >  Pl(^,i)([0A-.0](^,i)). 

We  now  dehne  beliefs.  Recall  that  true  — 0  means  that  0  is  more  plausible  than  =0 
according  to  agent’s  i  plausibility  measure.  We  might  say  that  in  this  case  the  agent  believes 
0.  However,  recall  that  the  agent  can  have  different  plausibility  assessments  at  different 
worlds.  Thus,  there  can  be  a  model  M,  and  worlds  tc,  w'  such  that  (tc,  w')  E  /Cj,  but  (M,  w)  |= 
true  -^i  0  while  (M,  w')  \=  -i{true  — 0).  (In  Example  5,  we  show  why  this  extra  expressive 
power  is  necessary.)  That  is,  0  is  more  plausible  than  =0  in  one  of  the  worlds  the  agent 
considers  possible,  but  not  in  another.  Since  our  intention  is  that  the  agent  should  not 
distinguish  between  accessible  worlds,  we  would  like  the  agent  to  have  the  same  beliefs  in  all 
the  worlds  he  considers  possible.  We  say  that  an  agent  believes  0  if  he  knows  that  0  is  more 
plausible  than  -i0  in  all  the  worlds  he  considers  possible.  Thus,  we  dehne  5^0,  read  “agent 
i  believes  0”,  as  an  abbreviation  for  Ki{true  — 0). 


2.5  Example:  Circuit  Diagnosis 


The  following  example  illustrates  some  of  the  expressive  power  of  this  language.  Although 
it  only  involves  one  agent  and  only  one  plausibility  measure  in  any  given  structure,  it  can 
easily  be  extended  to  allow  for  many  agents  with  different  plausibility  measures. 

The  circuit  diagnosis  problem  has  been  well  studied  in  the  literature  (see  [DH88]  for  an 
overview).  Consider  a  circuit  that  contains  n  logical  components  ci,...,Cn  and  k  lines 
/i, . . .  ,/fc.  As  a  concrete  example,  consider  the  circuit  of  Figure  1.^  The  diagnosis  task  is 
to  identify  which  components  are  faulty.  The  agent  can  set  the  values  of  input  lines  of  the 
circuit  and  observe  the  output  values.  The  agent  then  compares  the  actual  output  values  to 
the  expected  output  values  and  attempts  to  locate  faulty  components. 

^  The  “full  adder”  example  is  often  used  in  the  diagnosis  literature.  In  our  discussion  here  we 
loosely  follow  the  examples  of  Reiter  [Rei87]. 
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Fig.  1.  A  full  adder.  Xi  and  X2  are  XOR  gates,  Ai  and  A2  are  AND  gates,  and  Oi  is  an  OR  gate. 

We  model  this  situation  using  the  tools  we  presented  in  the  previous  sections.  We  start  by 
describing  the  agent’s  knowledge  using  a  Kripke  structure.  We  then  construct  two  possi¬ 
ble  plausibility  measures  over  worlds  in  this  Kripke  structures,  and  examine  the  resulting 
knowledge  and  belief. 


Knowledge  We  model  the  agent’s  knowledge  about  the  circuit  using  the  Kripke  struc¬ 
ture  =  {Wdiag)T^diagi^diag)-  Each  possible  world  w  G  Wdiag  K  composed  of  two  parts: 

fault{w),  the  failure  set — that  is,  the  set  of  faulty  components  in  w,  and  value{w),  the  value 
of  all  the  lines  in  the  circuit.  We  consider  only  worlds  where  the  components  that  are  not  in 
the  failure  sets  perform  as  expected.  For  example,  in  the  circuit  of  Figure  1,  if  the  AND  gate 
Ai  is  not  faulty,  then  we  require  that  I5  has  value  “high”  if  and  only  if  both  /i  and  I2  have 
the  value  “high”.  Most  accounts  of  diagnosis  assume  that  there  is  a  logical  theory  A  that 
describes  the  properties  of  the  device.  To  capture  our  intuition,  it  must  be  the  case  that  w 
is  a  possible  world  in  M  if  and  only  if  fault{w)  and  value{w)  are  together  consistent  with  A. 

The  most  straightforward  language  for  reasoning  about  faults  is  the  following:  let  ^diag  = 
{faulty{ci) , . . . ,  faulty{cn) ,  . . . ,  hi{lk)}  be  the  set  of  propositions,  where  each  faulty{ci) 

denotes  that  component  i  is  faulty  and  hi{li)  denotes  that  line  i  in  a  “high”  state.  We  then 
dehne  the  interpretation  Udiag  in  the  obvious  way:  diag{w){faulty[ci))  =  true  if  q  G  fault{w), 
and  7idiag{'w){hi{li))  =  true  if  (/*,  1)  G  value{w). 

Next,  we  need  to  dehne  the  agent’s  knowledge.  We  dehne  C  value{w)  to  be  the  values  of 
those  lines  the  agent  sets  or  observes.  The  agent  knows  which  tests  he  has  performed  and 
the  results  he  observed.  Therefore,  we  have  {w,w')  G  JCdiag  if  o^,  =  o^/.  For  example,  suppose 
the  agent  observes  hiifi)  A  hi{l2)  A  hi{l^)  A  hiil';)  A  The  agent  then  considers  possible  all 

worlds  where  the  same  observations  hold.  Since  these  observations  are  consistent  with  the 
correct  behavior  of  the  circuit,  one  of  these  worlds  has  an  empty  failure  set.  However,  other 
worlds  are  possible.  For  example,  it  might  be  that  the  AND  gate  A2  is  faulty.  This  would 
not  affect  the  outputs  in  this  case,  since  if  Ai  is  non-faulty,  then  its  output  is  “high”,  and 
thus,  Oi’s  output  is  “high”  regardless  of  A2’s  output. 
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Now  suppose  that  the  agent  observes  hi{li)  A  ^hi{l2)  A  hi{l^)  A  hiil'i)  A  -^hi{ls).  These  observa¬ 
tions  imply  that  the  circuit  is  faulty.  (If  /i  and  are  “high”  and  I2  is  “low” ,  then  the  correct 
values  for  and  /§  should  be  “low”  and  “high”,  respectively.)  In  this  case  there  are  several 
possible  failure  sets,  including  {Xi},  {X2,Oi},  and  {X2,  A2}. 

In  general,  there  is  more  than  one  explanation  for  the  observed  faulty  behavior.  Thus,  the 
agent  can  not  know  exactly  which  components  are  faulty,  but  he  may  have  beliefs  on  that 
score. 


Plausibility  To  model  the  agent’s  beliefs,  we  need  to  decide  on  the  plausibility  measure 
the  agent  has  at  any  world.  We  assume  that  only  failure  sets  are  relevant  for  determining 
a  world’s  plausibility.  Thus,  we  start  by  constructing  a  plausibility  measure  over  possible 
failures  of  the  circuit.  We  assume  that  failures  of  individual  components  are  independent  of 
one  another.  If  we  also  assume  that  the  likelihood  of  each  component  failing  is  the  same,  we 
can  construct  a  preference  ordering  on  failure  set  as  follows:  If  /i  and  /2  are  two  failure  sets, 
we  say  that  fi  is  preferred  to  /2  if  |/i|  <  I/2I,  that  is,  if  /i  consists  of  fewer  faulty  components 
than  /2.  This  preference  ordering  indnces  a  plausibility  measure  using  the  construction  of 
Proposition  2.  In  this  measnre  Pl(T’i)  <  P1(T2)  if  i^iii/eFid/l)  <  '^iii/eF2(|/|)- 

We  can  construct  the  same  plausibility  measure  based  on  probabilistic  arguments  using 
PPDs.  Snppose  that  the  probability  of  a  single  component  failing  is  e.  Since  we  have  assnmed 
that  failnres  are  independent,  it  follows  that  the  probability  of  a  failnre  set  /  is 
since  there  are  |/|  components  that  fail,  and  n—\f\  components  that  do  not  fail.  To  model  the 
behavior  of  small  bnt  nnknown  failnre  probability,  we  can  consider  the  PPD  (Pro,Pri, . . .), 
where  in  Pr^  the  probability  of  a  single  failnre  is  l/(m  -|-  1).  It  is  not  hard  to  check  that 
hmm^ooPrm(T’2)/Prm(T’i)  =  0  if  and  only  if  P1(F2)  <  Pl(T’i)  in  the  plausibility  measure 
described  above.  Interestingly,  this  plausibility  measure  is  almost  identical  to  the  ^-ranking 
in  which  K{{f})  =  |/|.  The  only  difference  is  that  if  |/i|  =  I/2I,  Pl({/i})  is  incomparable  to 
Pl({/2})  ill  fhe  plausibility  measure  we  constructed,  while  they  are  equal  according  to  the 
K-ranking. 

In  some  sitnations  it  might  be  nnreasonable  to  assnme  that  all  components  have  eqnal  failnre 
probability.  Thus,  we  might  assume  that  for  each  component  Cj  there  is  a  probability  e*  of 
failure.  If  we  assume  independence,  then  given  e  =  (ei, . . .  ,e„),  the  probability  of  a  failure 
set  /  is  Ilcje/ei  nc.^/(l  —  e*).  We  can  constrnct  a  PPD  that  captures  the  effect  of  the  efs 
getting  smaller,  but  at  possibly  different  rates:  Snppose  5^  is  a  bijection  from  IV™  to  IN. 
li  rh  =  {mi, . . .  ,mn),  let  Prg(^)  be  the  distribntion  where  the  probability  of  q  failing  is 
l/(mj  -|-  1),  for  i  =  1, . . . ,  n.  In  this  case,  we  get  that  lim^^oo  Prm(/2)/ Prm(/i)  =  0  if  and 
only  if  /2  is  a  strict  subset  of  /i,  i.e.,  if  /i  contains  all  the  components  in  /2  and  more.  Since 
we  do  not  assnme  any  relations  among  the  failure  probabilities  of  different  components,  it 
is  not  possible  to  compare  failnre  sets  nnless  one  is  a  snbset  of  the  other.  Thus,  we  can 
dehne  /  -<  /'  if  /  C  /'.  Using  the  construction  of  Proposition  2,  we  can  again  consider  the 
plausibility  measure  PI  induced  by  -<.  It  is  not  hard  to  see  that  P^Ui)  <  P1(T2)  if  for  every 
failnre  set  fi  E  Fi  —  F2  there  is  some  /2  G  F2  such  that  /2  -<  /i.  As  our  construction  shows. 
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this  plausibility  measure  can  be  induced  by  either  a  preference  ordering  or  a  PPD;  however, 
it  cannot  be  captured  by  a  ^-ranking  or  a  possibility  measure,  since  the  ordering  on  failure 
sets  is  partial. 


Beliefs  We  now  have  the  required  components  to  examine  the  agent’s  beliefs.  Using  the 
two  plausibility  measures  we  just  described,  we  can  construct  two  possible  structures  M^iag,! 
and  Md,iag,2-  In  both  structures  we  set  W{w,i)  =  l^diagi'w),  and  in  both  M^iag^i  and  Mdiag,2  the 
plausibility  measure  is  induced  from  a  preference  ordering  on  failures  (using  the  construction 
of  Proposition  2).  In  Mdiag,i,  we  take  the  plausibility  measure  to  be  such  that  Pl(^ 
Pl(^^i)({tc'})  if  and  only  if  \fault{w)\  <  \fault{w')\,  and  in  Mdiag,2  so  that  Pl(u,^i)({tc})  > 
Pl(^^i)({tc'})  if  and  only  if  fault{w)  C  fault{w').  It  is  easy  to  see  that,  in  both  structnres, 
if  there  is  a  world  w  in  which  these  observations  occur  and  where  fault{w)  =  0,  then  the 
agent  believes  that  the  circnit  is  faultless.  If  the  agent  detects  an  error,  he  believes  that 
it  is  caused  by  one  of  the  minimal  explanations  of  his  observations,  where  the  notion  of 
minimality  differs  in  the  two  strnctnres.  We  now  make  this  statement  more  precise.  Let 
/  be  a  failure  set.  Let  Df  he  the  formula  that  denotes  that  /  is  the  failure  set,  so  that 
{M,w)  1=  Df  if  and  only  if  fault{w)  =  f.  The  agent  believes  that  /  is  a  possible  diagnosis 
(i.e.,  an  explanation  of  his  observations)  if  -^Bi^Df.  The  set  of  diagnoses  the  agent  considers 
possible  is  Bel(M,  tc)  =  {/  :  {M,w)  \=  -^Bi^Df}.  We  say  that  a  failure  set  /  is  consistent 
with  an  observation  o  if  it  is  possible  to  observe  o  when  /  occurs,  i.e.,  if  there  is  a  world  w 
in  W  snch  that  fault{w)  =  f  and  o^  =  oD 

Proposition  3  (a)  Bel{Mdiag,i,w)  contains  all  failure  sets  f  that  are  consistent  with  Ow 
such  that  there  is  no  failure  set  f  with  \f'\  <  \  f\  which  is  consistent  with  o^. 

(b)  Bel{Mdiag,2)W)  contains  all  failure  sets  f  that  are  consistent  with  o^  such  that  there  is 
no  failure  set  f  with  f'  C  f  which  is  consistent  with  Ow 

PROOF.  Straightforward;  left  to  the  reader.  □ 


Thus,  both  Be\{Mdiag,i,  w)  and  Be\{Mdiag,2,  w)  consist  of  minimal  sets  of  failure  sets  consistent 
with  Ou,,  for  different  notions  of  minimality.  In  the  case  of  Mdiag,i,  “minimality”  means 
“of  minimal  cardinality”,  while  in  the  case  of  Mdiag,2,  it  means  “minimal  in  terms  of  set 
containment”.  This  proposition  shows  that  Mdiag,i  and  Mdiag,2  captnre  standard  assnmptions 
made  in  model-based  diagnosis;  Mdiag,i  captures  the  assumptions  made  in  [de  90],  while 
Mdiag,2  captures  the  assumptions  made  in  [Rei87].  More  concretely,  in  onr  example,  if  the 
agent  observes  hi{li)  A  ^hi{l2)  A  hOf^)  A  hiifj)  A  -^hi{ls),  then  in  Mdiag,i  she  would  believe  that 
Xi  is  faulty,  since  {Wi}  is  the  only  diagnosis  with  cardinality  one.  On  the  other  hand,  in 
Mdiag,2  she  would  believe  that  one  of  the  three  minimal  diagnoses  occurred:  {Wi},  {X2,Oi} 
or  {X2,^2}- 

^  Note  that  if  A  is  a  theory  that  describes  the  properties  of  circuit,  then  a  failure  /  is  consistent 
with  observation  o,  if  and  only  if  /  and  o  are  consistent  according  to  A. 
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2.6  Properties  of  Knowledge  and  Plausibility 


Kripke  structures  for  knowledge  and  plausibility  are  quite  similar  to  the  Kripke  structures  for 
knowledge  and  probability  introduced  by  Fagin  and  Halpern  [FH94a].  The  only  difference 
is  that  in  Kripke  structures  for  knowledge  and  probability,  Vi{w)  is  a  probability  space 
rather  than  a  plausibility  space.  Fagin  and  Halpern  explore  various  natural  restrictions  on 
the  interactions  between  the  probability  spaces  Vi{w)  and  the  accessibility  relations  /Cj. 
Here  we  investigate  restrictions  on  the  interaction  between  the  plausibility  spaces  and  the 
accessibility  relations.  Not  surprisingly,  some  of  these  conditions  are  exact  analogues  to 
conditions  investigated  by  Fagin  and  Halpern. 

Given  our  interest  in  the  KLM  properties,  we  will  be  interested  in  structures  that  satisfy  the 
following  condition: 

QUAL  is  qualitative  for  all  worlds  w  and  agents  i. 

The  same  arguments  that  show  that  A2  gives  us  the  AND  rule  also  show  that  it  gives  us 
property  K2  for  beliefs.  More  precisely,  we  have  the  following  result. 

Theorem  4  If  M  satisfies  QUAL,  then  for  all  worlds  w  in  M,  we  have 

(a)  {M,w)  1=  ((a  (p)  A  (a  ip))  ^  (a  {(p  Lip)) 

(b)  (M,  w)  1=  Bi(p  A  Biip  ^  Bi{(p  A  ip) 

(e)  {M,w)  1=  Bi(p  A  Bi{(p  Aip)  ^  Biip. 


PROOF.  Straightforward;  left  to  the  reader.  □ 


In  view  of  this  result,  we  typically  assume  that  QUAL  holds  whenever  we  want  to  reason 
abont  belief. 

The  set  consists  of  all  worlds  to  which  agent  i  assigns  some  degree  of  plausibility  in 

world  w.  We  would  not  expect  the  agent  to  place  a  positive  probability  on  worlds  that  he 
considers  impossible.  Similarly,  he  would  not  want  to  consider  as  plausible  (even  remotely) 
a  world  he  knows  to  be  impossible.  This  intnition  leads  us  to  the  following  condition,  called 
CONS  for  consisteney  (following  [FH94a]): 

CONS  PP  hPi{w)  for  all  worlds  w  and  all  agents  i.  ® 

^  We  remark  that  CONS  is  inappropriate  if  we  use  — >  to  model,  not  plausibility,  but  counterfactual 
conditions,  as  is  done  by  Lewis  [Lew73].  If  CONS  holds,  then  it  is  easy  to  see  that  Kip  Ki{-<p  — 
Ip)  is  valid,  for  all  ip.  That  is,  if  agent  i  knows  p,  then  he  knows  that  in  the  most  plansible  worlds 
where  ^p  is  trne,  p  is  vacuously  true,  because  there  are  no  plausible  worlds  where  -^p  is  true.  On 
the  other  hand,  under  the  counterfactual  reading,  it  makes  perfect  sense  to  say  “I  know  the  match 


16 


A  consequence  of  assuming  CONS  is  a  stronger  connection  between  knowledge  and  belief. 
Since  CONS  implies  that  the  most  plausible  worlds  are  in  /Cj(tc),  it  follows  that  if  the  agent 
knows  0  he  also  believes  0.  (Indeed,  as  we  shall  see,  this  condition  characterizes  CONS.) 

In  probability  theory,  the  agent  assigns  probability  1  to  the  set  of  all  worlds.  Since  1  >  0,  this 
means  the  agent  assigns  non-zero  probability  to  some  sets  of  worlds.  It  is  possible  to  have 
T  =  ±  in  plausibility  spaces.  If  this  happens,  the  agent  considers  all  sets  to  be  completely 
implausible.  The  following  condition,  called  NORM  for  normality  (following  [Lew73]),  says 
this  does  not  happen; 

NORM  V{w,i)  is  normal,  that  is,  T(^  p  >T(^  p,  for  all  worlds  w  and  all  agents  i. 

We  can  strengthen  this  condition  somewhat  to  one  that  says  that  the  agent  never  considers 
the  real  world  implausible.  This  suggests  the  following  condition;  Pl(^t,^j)({t(;})  >T.  Stating 
this  condition,  however,  leads  to  a  technical  problem.  Recall  that  Pl(^,i)  is  dehned  over  the 
set  of  measurable  subsets  of  In  general,  however,  singletons  may  not  be  measurable. 

Thus,  we  examine  a  slightly  weaker  condition  which  we  call  REF  for  reflexive  (following 
[Lew73]); 

REF  For  all  worlds  w  and  all  agents  i, 

•  w  E  and 

•  Pl(^^,,i)(A)  >T  for  all  A  G  iiF(w,i)  such  that  w  E  A. 

As  we  said  in  the  introduction,  much  of  the  previous  work  using  conditionals  assumed  (im¬ 
plicitly  or  explicitly)  that  the  agent  considers  only  one  plausibility  measure  possible.  This 
amounts  to  assuming  that  the  plausibility  measure  is  a  function  of  the  agent’s  epistemic 
state.  This  is  captured  by  an  assumption  called  SDP  (following  [FH94a])  for  state  deter¬ 
mined  plausibilities: 

SDP  For  all  worlds  w  and  w'  and  all  agents  i,  if  {w,w')  E  ICi  then  Vflw)  =  Vi{w'). 

It  is  easy  to  see  that  SDP  implies  that  an  agent  knows  his  plausibility  measure.  In  particular, 
as  we  shall  see,  with  SDP  we  have  that  0  — >■»  0  implies  Kflcj)  — 0). 

It  is  easy  to  verify  that  the  structures  described  in  the  diagnosis  example  of  Section  2.5 
satisfy  CONS,  REF,  and  SDP.  As  mentioned  in  the  introduction,  SDP  is  not  appropriate  in 
all  situations;  at  times  we  may  want  to  allow  the  agent  to  consider  possible  several  plausibility 
measures.  To  capture  this,  we  need  to  generalize  SDP.  The  following  example  might  help 
motivate  the  formal  dehnition. 

Example  5  This  is  a  variation  of  the  Liar’s  Paradox.  On  a  small  Paeific  island  there  are 
two  tribes,  the  Rightfeet  and  the  Leftfeet.  The  Rightfeet  are  known  to  usually  tell  the  truth, 
while  the  Leftfeet  are  known  to  usually  lie.  Alice  is  a  visitor  to  the  island.  She  encounters  a 
native.  Bob,  and  discusses  with  him  various  aspects  of  life  on  the  island.  Now,  Alice  does  not 

is  dry,  but  it  is  not  the  case  that  if  it  were  wet,  then  it  would  light  if  it  were  struck.” 
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know  to  what  tribe  Bob  belongs.  Thus,  she  considers  it  possible  both  that  Bob  is  a  Rightfoot 
and  that  he  is  a  Leftfoot.  In  the  first  case,  she  should  believe  what  he  tells  her  and  in  the 
second  she  should  be  skeptical. 

One  possible  way  of  capturing  this  situation  is  by  partitioning  the  worlds  Alice  considers 
possible  into  two  sets,  according  to  Bob’s  tribe.  Let  Wn  (resp.  Wl)  be  the  set  of  worlds 
that  Alice  considers  possible  where  Bob  is  a  Rightfoot  (resp.  Leftfoot).  As  the  discussion 
above  suggests,  Alice’s  plausibility  measure  at  the  worlds  of  Wr  gives  greater  plausibility 
to  worlds  where  Bob  is  telling  the  truth  than  to  worlds  where  Bob  is  lying;  the  opposite 
situation  holds  at  worlds  of  Wr.  In  such  a  structure,  the  formula  -^K Aiice~'{tell{4>)  Alice 
-10)  A  -^K Aiice^(tell{(f))  Alice  0)  is  satisfiablc,  where  telfifi)  is  the  formula  that  holds  when 
Bob  tells  Alice  0.  On  the  other  hand,  in  structures  satisfying  SDR,  this  formula  is  satisfiablc 
only  when  telfifi)  has  plausibility  ±  in  all  the  worlds  that  Alice  considers  possible. 

While  this  example  may  seem  contrived,  in  many  situations  it  is  possible  to  extract  param¬ 
eters  such  as  Leftfoot  and  Rightfoot  that  determine  which  conditional  statements  are  true. 
For  example,  when  we  introduce  time  into  the  picture  (in  Section  3.1),  these  parameters 
might  be  the  agent’s  own  actions  in  the  future.  Such  a  partition  allows  us  to  make  state¬ 
ments  such  as  “I  do  not  know  whether  0  is  plausible  or  not,  but  I  know  that  if  I  do  a,  then 
0  is  plausible”,  where  0  is  some  statement  about  the  future.  If  the  agent  does  not  know  the 
value  of  these  parameters,  she  will  not  necessarily  know  which  conditionals  are  true  at  a 
given  world  (as  was  the  case  in  the  example  above). 

Example  5  motivates  the  condition  called  uniformity. 

UNIF  For  all  worlds  w  and  agents  i,  if  w'  G  then  Vfiw)  =  Vfiw').  ® 

It  is  not  hard  to  show  that  UNIF  holds  if  and  only  if,  for  each  agent  i,  we  can  partition 
the  set  of  possible  worlds  in  such  a  way  that  for  each  cell  C  in  the  partition,  there  is  a 
plausibility  space  (Wc,  Pic)  such  that  Wc  C  C  and  Vfiw)  =  {Wc,  Pic)  for  all  worlds  w  E  C. 
Moreover,  if  CONS  also  holds,  then  this  partition  rehnes  the  partition  induced  by  the  agent’s 
knowledge,  i.e.,  if  C  is  a  cell  in  the  partition  and  w  is  some  world  C,  then  C  C  ICfiw).  It 
easily  follows  that  SDP  and  CONS  together  imply  UNIF. 

When  we  model  uncertainty  about  the  relative  plausibility  of  different  worlds  this  way  it 
is  reasonable  to  demand  that  the  plausibility  measure  totally  orders  all  events;  i.e.,  it  is  a 
ranking.  The  RANK  assumption  is: 

RANK  For  all  worlds  w  and  agents  i,  Vfiw)  is  a  ranking,  that  is,  for  all  sets  A,B  W^, 
either  PR(A)  <  PU(R)  or  PU(R)  <  PU(A),  and  PU(AUi?)  =  max(PU(A),  PR(R)). 

Note  that  ^-rankings  and  possibility  measures  are  two  examples  of  rankings.  Additionally, 
rational  preference  orderings  of  [KLM90]  are  essentially  rankings  in  the  sense  that  for  each 

®  This  condition  is  not  the  same  as  uniformity  as  defined  in  [Lew73];  rather,  it  corresponds  in  the 
Lewis  terminology  to  absoluteness. 
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rational  preference  ordering  we  can  construct  a  ranking  that  satisfies  exactly  the  same  con¬ 
ditional  statements  [Fri97,FH97b]. 

While  rankings  are  quite  natural,  they  have  often  been  rejected  as  being  too  inexpressive 
[Gin86].  In  a  ranking  there  is  a  total  order  on  events.  The  standard  argument  for  partial  orders 
is  as  follows:  In  general,  an  agent  may  not  be  able  to  determine  the  relative  plausibility  of  a 
and  b.  If  the  plausibility  measure  is  a  ranking,  the  agent  is  forced  to  make  this  determination; 
with  a  partial  order,  he  is  not.  This  argument  loses  much  of  its  force  in  our  framework,  once 
we  combine  knowledge  and  plausibility.  As  we  said  above,  the  agent’s  ignorance  can  be 
modeled  by  allowing  him  to  consider  (at  least)  two  rankings  possible,  one  in  which  a  is  more 
plausible  than  b,  and  one  in  which  b  is  more  plausible  that  a.  The  agent  then  believes  neither 
that  a  is  more  plausible  than  b  nor  that  b  is  more  plausible  than  a. 


2.1  Knowledge  and  Belief 


How  reasonable  is  the  notion  of  belief  we  have  dehned?  In  this  section,  we  compare  it  to 
other  notions  considered  in  the  literature. 

Recall  that  be  the  language  where  the  only  modal  operators  are  Ri, . . . ,  B^.  Let  be 
the  language  where  we  have  iFi, . . . ,  and  Ri, . . . ,  (but  no  — operators).  It  is  not  hard 
to  see  (and  will  follow  from  our  proofs  below)  that  to  get  belief  to  satisfy  even  minimal  such 
as  K2,  we  need  the  AND  rule  to  hold.  Thus,  in  this  section,  we  restrict  attention  to  Kripke 
structures  for  knowledge  and  plausibility  that  satisfy  QUAL.  We  then  want  to  investigate 
the  impact  of  adding  additional  assumptions.  Let  M.  be  the  set  of  all  Kripke  structures  for 
knowledge  and  plausibility  that  satisfy  QUAL,  and  let  (resp.  _A/JCONs,norm^ 

structures  satisfying  QUAL  and  CONS  (resp.  QUAL,  CONS  and  NORM). 

Work  on  belief  and  knowledge  in  the  literature  [HM92,Hin62,Lev84]  has  focused  on  the  modal 
systems  S5,  KD45,  K45,  and  K  with  semantics  based  on  Kripke  structures  as  described 
in  Section  2.1.  Before  we  examine  the  properties  of  belief  in  our  approach,  we  relate  our 
semantics  of  belief  (in  terms  of  plausibility)  to  the  more  standard  Kripke  approach,  which 
presumes  that  belief  is  dehned  in  terms  of  a  binary  relation  Can  we  dehne  a  relation  Bi 
in  terms  of  /Cj  and  Vi  such  that  {M,w)  \=  Bicf  if  and  only  if  {M,v)  \=  0  for  all  v  G  Bi{w)l 
We  show  that  this  is  possible  in  some  structures,  but  not  in  general. 

Let  S  =  (W,  PI)  be  a  qualitative  plausibility  space.  We  say  that  A  C  IF  is  a  set  of  most 
plausible  worlds  if  P1(A)  >  P1(A)  (where  A  is  the  complement  of  A,  i.e.,  W  —  A)  and  for 
all  B  G  A,  P1(H)  ^  Pl{B).  That  is,  A  is  a  minimal  set  of  worlds  that  is  more  plausible 
than  its  complement.  It  is  easy  to  verify  that  if  such  a  set  exists,  then  it  must  be  unique. 
To  see  this,  suppose  that  A  and  A'  are  both  sets  of  most  plausible  worlds.  We  now  show 
that  P1(A  n  A')  >  P1(A  n  A').  Since  A  and  A'  are  both  most  plausible  sets  of  worlds,  this 
will  show  that  we  must  have  A  =  A'.  To  see  that  P1(A  fl  A')  >  Pl(An  A'),  hrst  note 
that  A  n  A',  A  —  A'  and  A  are  pairwise  disjoint.  Since  A  and  A'  are  most  plausible  sets 
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of  worlds,  we  have  that  Pl((^  H  A')  U  (A  —  A'))  =  P1(A)  >  P1(A)  and  Pl((^  fl  A')  U  A)  > 
P\((A  n  A')  U  (A'  -  A))  =  Pl(A')  >  Pim  >  P\(A  -  A').  We  can  apply  A2  to  get  that 
P1(A  n  A')  >  P1((A  -  A')  U  A)  =  Pl(An  W). 

In  hnite  plausibility  structures  (that  is,  ones  with  only  hnitely  many  worlds),  it  is  easy  to  see 
that  there  is  always  a  (unique)  set  of  most  plausible  worlds.  In  general,  however,  a  set  of  most 
plausible  worlds  does  not  necessarily  exist.  For  example,  consider  the  space  S'o  =  (IF,  PI), 
where  IF  =  {wi  :  i  >  0}  and  PI  is  dehned  as  follows:  P1(A)  =  cx)  if  A  contains  an  inhnite 
number  of  worlds,  and  P1(A)  =  maXw^£A{i)  otherwise.  Suppose  that  P1(A)  >  P1(A).  A  must 
be  hnite,  for  otherwise  P1(A)  =  oo.  Thus,  A  must  be  inhnite.  Suppose  Wi  G  A.  It  is  easy 
to  see  that  A  —  {wi}  is  inhnite  and  A  —  {wi}  is  hnite.  Thus,  P1(A  —  {tCj})  >  P1(A  —  {tCi}). 
This  shows  that  there  does  not  exist  a  set  of  most  plausible  worlds  in  S. 

If  there  is  no  set  of  most  plausible  worlds,  then  we  may  not  be  able  to  hnd  a  relation  Bi 
that  characterizes  agent  f’s  beliefs.  For  example,  consider  the  structure  M  =  (IF,  tt, /Ci,  Pi), 
where  IF  =  {wi  :  i  >  0}  is  the  set  of  worlds  described  in  S'o  above;  n  assigns  truth  values 
to  primitive  propositions  pi,P2, ...  in  such  a  way  that  n{wi){pj)  =  true  if  and  only  if  J>^; 
/Cl  is  the  complete  accessibility  relation  /Ci  =  IF  x  IF;  and  Viiwi)  is  the  space  S'o  described 
above.  It  is  not  hard  to  verify  that  {M,wo)  \=  Bi(p  if  and  only  if  is  a  hnite  set, 

i.e.,  there  is  an  index  i  such  that  for  all  j  >  i,  we  have  {M,Wj)  \=  0.  Thus,  {M,wo)  \=  BiPj 
for  all  j  >  0.  Yet  there  are  no  worlds  in  the  model  that  satisfy  all  the  propositions  pj  at 
once.  Thus,  there  is  no  accessibility  relation  Bi  that  characterizes  agent  I’s  beliefs  in  wq. 

On  the  other  hand,  we  can  show  that  if  there  is  always  a  set  of  most  plausible  worlds,  then 
we  can  characterize  the  agents’  beliefs  by  an  accessibility  relation.  Let  S  =  (IF,  PI)  be  a 
plausibility  space.  Dehne  MP(S')  to  be  the  set  of  most  plausible  worlds  in  S  if  it  exists,  and 
0  if  Pl(IF)  =  T.  Otherwise  MP(S')  is  not  dehned. 

Proposition  6  Let  M  he  a  Kripke  structure  for  knowledge  and  plausibility.  If  MPifPiiw')) 
is  defined  for  all  w'  G  lCi{w),  then  {M,w)  \=  B^cf  if  and  only  if  {M,w")  \=  0  for  all  w"  G 
Uto'G/Ci(«;)TfP(Pi  {w') ) . 


PROOF.  Straightforward;  left  to  the  reader.  □ 


This  proposition  implies  that,  if  most  plausible  sets  of  worlds  always  exist  in  M,  then  we  can 
set  Biiw)  =  U^/e^.(^)MP(Pj(t(;'))  and  recover  the  usual  Kripke-style  semantics  for  belief. 

This  discussion  shows  that  our  model  of  belief  is  more  general  than  the  classical  Kripke- 
structure  account  of  beliefs,  since  there  are  models  where  the  agent’s  beliefs  are  not  de¬ 
termined  by  a  set  of  accessible  worlds.  However,  as  we  shall  see,  this  does  not  lead  to  new 
properties  of  beliefs  in  Roughly  speaking,  this  is  because  we  have  a  hnite  model  property: 
a  formula  in  is  satishable  if  and  only  if  it  is  satishable  in  a  hnite  model  (see  Theorem  13 
below).  It  is  easy  to  verify  that  in  a  hnite  model  MP(Pj(t(;))  is  always  dehned.  We  note. 
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however,  that  this  hnite  model  property  is  no  longer  true  when  we  consider  the  interaction 
of  beliefs  with  other  modalities,  such  as  time,  or  when  we  examine  the  first-order  case.  In 
these  situations,  the  two  models  of  beliefs  are  not  equivalent.  Plausibility  is  strictly  more 
expressive;  see  [FHK96]. 

We  now  examine  the  formal  properties  of  belief  and  knowledge  in  structures  of  knowledge 
and  plausibility.  We  start  by  restricting  our  attention  to  .  As  we  show  below,  the  modal 
system  K  precisely  characterizes  the  valid  formulas  of  in  the  class  Ai.  However,  in  the 
literature,  belief  has  typically  been  taken  to  be  characterized  by  the  modal  system  K45  or 
KD45,  not  K.  We  get  K45  by  restricting  to  models  that  satisfy  CONS,  and  KD45  by  further 
restricting  to  models  that  satisfy  NORM.  Thus,  the  two  requirements  that  are  most  natural, 
at  least  if  we  have  a  probabilistic  intuition  for  plausibility,  are  already  enough  to  make  Bi  a 
KD45  operator. 

Theorem  7  K  (resp.,  K45,  KD^S)  is  a  sound  and  complete  axiomatization  for  with 
respect  to  Ai  (resp.,  cons, norm 


PROOF.  See  Appendix  A.l.  □ 


We  now  consider  knowledge  and  belief  together.  This  combination  has  been  investigated  in 
the  literature  [KL88,Voo92].  In  particular,  Kraus  and  Lehmann  [KL88]  dehne  Kripke  struc¬ 
tures  for  knowledge  and  belief  that  have  two  accessibility  relations,  one  characterizing  the 
worlds  that  are  knowledge-accessible  and  one  characterizing  worlds  that  are  belief-accessible. 
Ki  and  R  are  dehned,  as  usual,  in  terms  of  these  relations.  They  argue  that  the  two  acces¬ 
sibility  relations  must  be  coherent  in  the  sense  that  the  agent  knows  what  she  believes  and 
believes  what  she  knows  to  be  true.  Kraus  and  Lehmann  describe  restrictions  on  the  inter¬ 
action  between  the  two  relations  that  force  this  coherence.  They  show  that  in  the  resulting 
structures,  the  interactions  between  knowledge  and  belief  are  characterized  by  the  following 
axioms. 

KBl.  Biff  KiBicf 

KB2.  Ki(j)  Bi(f) 

It  turns  out  that  KBl  holds  in  Ai  and  KB2  is  a  consequence  of  CONS.  To  see  this,  recall 
that  Bi(()  =  Ki{true  — >  0).  Using  positive  introspection  for  knowledge  (axiom  K4),  we  derive 
that  Bi(j)  ^  KiKi{true  — >  0).  This  is  equivalent  to  axiom  KBl.  When  M  satishes  CONS,  we 
have  that  W(^u!,i)  ^  Ai{w).  If  {M,w)  \=  Kicf),  then  all  worlds  in  ICi{w)  satisfy  0.  This  implies 
that  there  are  no  worlds  satisfying  ->0  in  IU(^,i),  and  thus  B^cf  must  hold.  Thus,  KB2  must 
hold. 

We  now  state  this  formally.  Let  AX^®  consist  of  the  S5  axioms  for  the  operators  the  K 
axioms  for  the  operators  R,  together  with  KBl;  let  consist  of  AX^^  together 


21 


with  the  K4  and  K5  axioms  for  Bi  and  KB2;  and  let  consist  of 

together  with  the  K6  axiom  for  B^. 

Theorem  8  XX™  (resp.,  ^j^kb.cons.norm^  ^  sound  and  complete  axioma- 

tization  of  with  respect  to  M  (resp.,  Ancons, norm^^ 


PROOF.  See  Appendix  A.l.  □ 


As  an  immediate  corollary,  we  get  that  there  is  a  close  relationship  between  our  framework 
and  that  of  [KL88].  Let  XL  be  the  logic  of  Kraus  and  Lehmann: 

Corollary  9  For  any  0  G  ,  KL  |=  0  if  and  only  if  J^^ons, norm  |_ 

We  now  relate  to  three  other  notions  of  beliefs  in  the  literature — those  of  Moses  and  Shoham 
[MS93],  Voorbraak  [Voo92],  and  Lamarre  and  Shoham  [LS94]. 

Moses  and  Shoham  [MS93]  also  view  belief  as  being  derived  from  knowledge.  The  intuition 
that  they  try  to  capture  is  that  once  the  agent  makes  a  defeasible  assumption,  the  rest  of 
his  beliefs  should  follow  from  his  knowledge.  In  this  sense,  Moses  and  Shoham  can  be  viewed 
as  focusing  on  the  implications  of  an  assumption  and  not  on  how  it  was  obtained.  We  can 
understand  their  notion  as  saying  that  0  is  believed  if  it  is  known  to  be  true  in  the  most 
plausible  worlds.  But  for  them,  plausibility  is  not  dehned  by  an  ordering.  Rather,  it  is  dehned 
in  terms  of  a  formula,  which  can  be  thought  of  as  characterizing  the  most  plausible  worlds. 
More  formally,  for  a  hxed  formula  a,  they  dehne  Bf(j)  to  be  an  abbreviation  for  Ki{a  ^  0).  ^ 
The  following  result  relates  our  notion  of  belief  to  that  of  Moses  and  Shoham. 

Lemma  10  Let  M  be  a  propositional  Kripke  structure  of  knowledge  and  plausibility  satis¬ 
fying  CONS  and  SDP.  Suppose  that  w,  i,  and  a  are  such  that  the  most  plausible  worlds  in 
Viiw)  are  exactly  those  worlds  in  lCi{w)  that  satisfy  a,  i.e.,  MPifPiiw))  =  {w'  G  ICi{w)  : 
{M,w')  \=  a}.  Then  for  any  formula  0  G  that  includes  only  the  modalities  Ki  and  Bi, 
{M,w)  \=  0  if  and  only  if  {M,w)  \=  0*,  where  0*  is  the  result  of  recursively  replacing  each 
subformula  of  the  form  Biip  in  0  by  Ki{a  ^  fj*) . 

PROOF.  See  Appendix  A.l.  □ 


Voorbraak  [Voo92]  distinguishes  two  notions  of  knowledge:  objective  knowledge  and  true 
justified  belief.  He  then  studies  the  interaction  of  both  notions  of  knowledge  with  beliefs.  The 
intuition  we  assign  to  knowledge  is  similar  to  Voorbraak’s  intuition  for  objective  knowledge. 

^  Shoham  and  Moses  also  examine  two  variants  of  this  definition.  These  mainly  deal  with  the 
cases  where  a  is  inconsistent  with  the  agent’s  knowledge.  For  simplicity,  we  assume  here  that  a  is 
consistent  with  the  agent’s  knowledge. 
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However,  Voorbraak  objects  to  the  axiom  Kicf)  Bi((),  and  suggests  Bicf)  BiKicj).  The 
difference  lies  in  the  interpretation  of  belief.  Voorbraak’s  notion  of  belief  is  stronger  than 
ours.  His  view  is  that  the  agent  cannot  distinguish  what  he  believes  from  what  he  knows 
(indeed,  he  believes  that  what  he  believes  is  the  same  as  what  he  knows).  Our  notion  of 
belief  is  weaker,  in  that  we  allow  agents  to  be  aware  of  the  defeasibility  of  their  beliefs. 

Lamarre  and  Shoham  [LS94]  investigate  the  notion  of  knowledge  as  justihed  true  belief  using 
a  framework  that  is  very  similar  to  ours.  They  start  with  an  explicit  preference  ordering 
over  possible  worlds,  and  then  dehne  to  read  “given  evidence  a,  0  holds  in  the  most 
plausible  a-worlds” .  Their  formal  account  of  B^fj)  is  exactly  a  -^i  0  in  our  notation.  Unlike 
us,  they  examine  a  notion  of  knowledge  as  “belief  stable  under  incorporation  of  correct 
facts”,  which  is  rather  different  then  our  notion  of  objective  knowledge.  Thus,  while  the 
technical  construction  is  similar,  the  resulting  framework  is  substantially  different.  Lamarre 
and  Shoham  take  plausibility  to  be  the  only  primitive,  and  use  it  to  determine  both  knowledge 
and  belief.  We  take  both  knowledge  and  plausibility  to  be  primitive,  and  use  them  to  dehne 
belief. 


2.8  Axiomatizing  the  Language  of  Knowledge  and  Plausibility 


Up  to  now,  we  have  considered  just  the  restricted  language  .  We  now  present  sound 
and  complete  axiomatizations  for  the  full  language  The  technical  details  are  much  in 

the  spirit  of  the  axiomatizations  presented  in  [FH94a]  for  knowledge  and  probability.  Our 
complete  axiomatization  for  M.  consists  of  two  “modules”:  a  complete  axiomatization  for 
knowledge  (i.e.,  S5)  and  a  complete  axiomatization  for  conditionals.  In  the  general  case, 
there  are  no  axioms  connecting  knowledge  and  plausibility.  For  each  of  the  conditions  we 
consider,  we  provide  an  axiom  that  characterizes  it.  The  axioms  characterizing  NORM,  REF, 
RANK,  and  UNIF  are  taken  from  [Lew73]  and  [BurSl]  (see  also  [Fri97,FH97b]),  while  the 
axioms  for  CONS  and  SDP  (and  also  UNIF)  correspond  directly  to  the  axioms  suggested 
in  [FH94a]  for  their  probabilistic  counterparts.  We  also  provide  complete  characterizations 
of  the  complexity  of  the  validity  problem  for  all  the  logics  considered,  based  on  complexity 
results  for  knowledge  [HM92]  and  for  conditionals  [FH96a]. 

The  axiom  system  can  be  modularized  into  three  components:  propositional  reasoning,  rea¬ 
soning  about  knowledge,  and  reasoning  about  conditionals.  The  component  for  propositional 
reasoning  consists  of  K1  and  RKl  (from  Section  2.1);  the  component  for  reasoning  about 
knowledge  consists  of  K2-K5  and  RK2  (from  Section  2.1);  the  component  for  reasoning 
about  conditionals  consists  of  the  standard  axioms  and  rules  for  conditional  logic  C1-C4, 
RCl,  and  RC2  described  in  [Fri97,FH97b]  following  [BurSl, Lew73]: 


Cl.  0^ 

0 

C2.  ((0- 

0l)  A  (0  - 

^  02))  ^  (0  - 

♦  (01  A  02)) 

C3.  ((01 

^  0)  A  (02  - 

0))  ^  ((01 

V  02)  - 

4  0) 

C4.  ((01 

^  02)  A  (01 

0))  ^  ((0] 

L  A  02)  - 

0) 
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Rl.  From  0  and  0  0  infer  0 

RCl.  From  0-^0'  infer  {(j)  ^  'ip)  ^  (0'  — >  0) 

RC2.  From  pj  ^  pj'  infer  (0  — >  0)  (0  — >  0') 

Let  AX  consist  of  K1-K5,  C1-C4,  RKl,  RK2,  RCl,  and  RC2. 

Theorem  11  AX  is  a  sound  and  complete  axiomatization  for  with  respect  to  AA. 

PROOF.  See  Appendix  A. 2.  □ 


We  now  capture  the  conditions  described  above — CONS,  NORM,  REF,  SDR,  UNIF,  and 
RANK — axiomatically. 

RANK,  NORM,  REF,  and  UNIF  correspond  the  axioms  C5-C8,  respectively,  from  [Fri97,FH97b]: 

C5.  0  — >  0  A  -1(0  — >  -1.^)  ^  (J)  Af,  —>•0 
C6.  {true  ^  false). 

C7.  N(j)^(j) 

C8.  [(0  — >•  0)  N{(j)  — >  0)]  A  [-1(0  — >  0)  N->{(j)  — >•  0)] 

CONS  and  SDP  correspond  to  the  following  axioms,  respectively; 

C9.  Ki(j)  ^  Ni(j) 

CIO.  (0  0)  ^  Ki{(()  0) 

It  is  interesting  to  note  that  the  axioms  for  CONS  and  UNIF  are  derived  from  the  axioms 
dehned  in  [FH94a]  by  replacing  tc(0)  =  1  (the  probability  of  0  is  1)  by  Aj0,  which  has 
a  similar  reading.  We  show  that  adding  the  appropriate  axioms  to  AX  gives  a  sound  and 
complete  axiomatization  of  the  logic  with  respect  to  the  class  of  structures  satisfying  the 
corresponding  conditions. 

Theorem  12  Let  A  be  a  subset  of  {RANK,  NORM,  REF,  UNIF,  CONS,  SDP}  and  let  A 
be  the  corresponding  subset  of  { 05,  06,  Cl,  08,  09,  Cl  0} .  Then  AX  U  A  is  a  sound  and 
complete  axiomatization  with  respect  to  the  structures  in  AA  satisfying  A. 


PROOF.  See  Appendix  A. 2.  □ 


We  now  consider  the  complexity  of  the  validity  problem.  Our  results  are  based  on  a  combi¬ 
nation  of  results  for  complexity  of  epistemic  logics  [HM92]  and  conditional  logics  [FH96a]. 
Again,  the  technical  details  are  much  in  the  spirit  of  those  in  [FII94a]. 
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We  start  with  few  results  that  will  be  useful  in  our  discussion  of  complexity.  As  is  often  the 
case  in  modal  logics,  we  can  prove  a  “small  model  property”  for  our  logic:  if  a  formula  is 
satisfiable  at  all,  it  is  satisfiable  in  a  small  model.  Let  Sub{(j))  be  the  set  of  subformulas  in  0. 
It  is  easy  to  see  that  an  upper  bound  on  \Sub{(l))\  is  the  number  of  symbols  in  0. 

Theorem  13  Let  A  be  a  subset  of  {CONS,  NORM,  REF,  SDR,  UNIF,  RANK}.  The  formula 
0  is  satisfiable  in  a  Kripke  strueture  satisfying  A  if  and  only  if  it  is  satisfiable  in  a  Kripke 
strueture  with  at  most  I  worlds. 


PROOF.  See  Appendix  A. 2.  □ 


This  shows  that  if  0  is  satishable,  then  it  is  satishable  in  a  model  with  at  most  exponential 
number  of  worlds.  Such  a  “small  model”  result  is  useful  when  we  consider  upper  bound  on 
the  complexity  of  checking  satishable.  Roughly  speaking,  if  there  is  a  small  model,  then  we 
can  construct  this  model  in  time,  say,  exponential  in  the  size  of  the  formula.  However,  there 
is  one  problem  with  the  result  we  have  just  proved.  This  “small”  number  of  worlds  does  not 
necessarily  mean  that  we  can  compactly  describe  the  Kripke  structure.  Recall  that  Pl(t„,j) 
describes  an  ordering  over  subsets  of  W(.uj,i)-  Thus,  in  the  worst  case,  we  need  to  describe 

an  ordering  on  sets  of  worlds.  Thus,  the  representation  of  a  structure  might  be 

exponential  in  the  number  of  worlds.  Fortunately,  we  can  show  that  a  satishable  formula  is 
satishable  in  a  small  model  with  a  compact  representation. 

We  start  with  a  dehnition.  We  say  that  M  =  {W,  tt,  /Ci, . . . ,  /C„,  Vi, . . . ,  Vn)  is  a  preferential 
(Kripke)  strueture  if  for  each  Vi{w),  there  is  a  preference  ordering  -<{w,i)  on  that 

induces  Pl(u,,i)  using  the  construction  of  Proposition  2.  Recall  that  a  preference  ordering  is  a 
binary  relation  on  the  set  of  possible  worlds.  Thus,  if  W  is  hnite,  we  can  describe  the  relations 
/Cj  and  the  preference  orderings  using  tables  of  size  at  most  |IF|^.  So  the  representation 
of  such  structures  is  polynomial  in  |IF|.  Is  it  possible  to  hnd  a  small  preferential  Kripke 
structure  satisfying  0?  Indeed  we  can.  Using  results  of  [FH96a],  we  immediately  get  the 
following  lemma: 

Lemma  14  Let  A  be  a  subset  of  [CONS,  NORM,  REF,  SDR,  UNIF,  RANK}.  If  a  formula 
0  is  satisfiable  in  a  Kripke  strueture  satisfying  A  with  N  worlds,  then  0  is  satisfiable  in  a 
preferential  Kripke  strueture  with  at  most  |Sub(0)|A^  worlds. 

Combining  this  with  Theorem  13,  we  conclude  that  if  0  is  satishable,  then  it  is  satishable 
in  a  structure  of  exponential  size  with  an  exponential  description.  It  can  be  shown  that  this 
result  is  essentially  optimal  (see  [HM92,FH96a]).  However,  if  there  is  only  one  agent  and  we 
assume  CONS  and  either  UNIF  or  SDP,  then  we  can  get  polynomial-sized  models. 

Theorem  15  Let  A  be  a  subset  of  {CONS,  NORM,  REF,  SDP,  UNIF,  RANK}  eontaining 
CONS  and  either  SDP  or  UNIF.  If  0  talks  about  the  knowledge  and  plausibility  of  only  one 
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agent,  then  0  is  satisfiable  in  a  Kripke  structure  satisfying  A  if  and  only  if  it  is  satisfiable 
in  a  preferential  Kripke  structure  satisfying  A  with  at  most  |Sub(0)|^  worlds. 


PROOF.  See  Appendix  A. 2.  □ 


We  now  consider  the  complexity  of  decision  procedure  for  the  validity  problem.  The  difficulty 
of  deciding  whether  0  is  valid  is  a  function  of  the  length  of  0,  written  |0|. 

Theorem  16  Let  A  be  a  subset  of  [CONS,  NORM,  REF,  SDR,  UNIF,  RANK}.  If  CONS  e 
A,  but  it  is  not  the  case  that  UNIF  or  SDR  is  in  A,  then  the  validity  problem  with  respect 
to  structures  satisfying  A  is  complete  for  exponential  time.  Otherwise,  the  validity  problem 
is  complete  for  polynomial  space. 


PROOF.  See  Appendix  A. 2.  □ 


If  we  restrict  attention  to  the  case  of  one  agent  and  structures  satisfying  CONS  and  either 
UNIF  or  SDP,  then  we  can  do  better. 

Theorem  17  Let  A  be  a  subset  of  {CONS,  NORM,  REF,  SDP,  UNIF,  RANK}  containing 
CONS  and  either  UNIF  or  SDP.  For  the  case  of  one  agent,  the  validity  problem  in  models 
satisfying  A  is  co- NR- complete. 


PROOF.  See  Appendix  A. 2.  □ 


3  Adding  Time 


In  the  previous  section,  we  developed  a  model  of  knowledge  and  beliefs.  Having  a  good  model 
of  knowledge  and  belief  is  not  enough  in  order  to  study  how  beliefs  change.  Indeed,  if  we  are 
mainly  interested  in  agents’  beliefs,  the  additional  structure  of  plausibility  spaces  does  not 
play  a  signihcant  role  in  a  static  setting.  However,  if  we  introduce  an  explicit  notion  of  time, 
we  expect  the  plausibility  measure  to  (partially)  determine  how  agents  change  their  beliefs. 
As  we  shall  see,  this  gives  a  reasonable  notion  of  belief  change. 

In  this  section,  we  introduce  time  into  the  framework.  We  then  examine  how  time,  knowledge, 
and  plausibility  interact.  In  particular,  we  suggest  a  notion  of  conditioning  that  captures  the 
intuition  that  plausibility  changes  in  the  minimal  way  that  is  required  by  changes  to  the 
agent’s  knowledge. 
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3.1  Knowledge  and  Plausibility  in  Multi- Agent  Systems 


A  straightforward  approach  to  adding  time  is  by  introducing  another  accessibility  relation 
on  worlds,  which  characterizes  their  temporal  relationship  (see,  for  example,  [KL88]).  We 
introduce  more  structure  into  the  description  by  adopting  the  framework  of  Halpern  and 
Fagin  [HF89]  for  modeling  multi-agent  systems.  This  structure  gives  a  natural  dehnition  of 
knowledge  and  an  intuitive  way  to  describe  agents’  interactions  with  their  environment.  We 
start  by  describing  the  framework  of  Halpern  and  Fagin,  and  then  add  plausibility. 

The  key  assumption  in  this  framework  is  that  we  can  characterize  the  system  by  describing 
it  in  terms  of  a  state  that  changes  over  time.  This  is  a  powerful  and  natural  way  to  model 
systems.  Formally,  we  assume  that  at  each  point  in  time,  each  agent  is  in  some  loeal  state. 
Intuitively,  this  local  state  encodes  the  information  that  is  available  to  the  agent  at  that  time. 
In  addition,  there  is  an  environment,  whose  state  encodes  relevant  aspects  of  the  system  that 
are  not  part  of  the  agents’  local  states.  For  example,  if  we  are  modeling  a  robot  that  navigates 
in  some  office  building,  we  might  encode  the  robot’s  sensor  input  as  part  of  the  robot’s  local 
state.  If  the  robot  is  uncertain  about  his  position,  we  would  encode  this  position  in  the 
environment  state. 

A  global  state  is  a  tuple  (sg,  Si, . . . ,  s„)  consisting  of  the  environment  state  Sg  and  the  local 
state  Si  of  each  agent  i.  A  run  of  the  system  is  a  function  from  time  (which,  for  ease  of 
exposition,  we  assume  ranges  over  the  natural  numbers)  to  global  states.  Thus,  if  r  is  a 
run,  then  r(0),r(l), ...  is  a  sequence  of  global  states  that,  roughly  speaking,  is  a  complete 
description  of  what  happens  over  time  in  one  possible  execution  of  the  system.  We  take  a 
system  to  consist  of  a  set  of  runs.  Intuitively,  these  runs  describe  all  the  possible  sequences 
of  events  that  could  occur  in  a  system. 

Given  a  system  TZ,  we  refer  to  a  pair  (r,  m)  consisting  of  a  run  r  G  7^  and  a  time  m  as  a  point. 
If  r{m)  =  (sg,  si, . . . ,  Sn),  we  dehne  rj(m)  =  sp,  thus,  ri{m)  is  agent  i’s  local  state  at  the 
point  {r,m).  Finally,  to  reason  in  a  logical  language  about  such  a  system,  we  need  to  assign 
truth  values  to  primitive  propositions.  An  interpreted  system  is  a  tuple  (TZ,  n)  consisting  of  a 
system  TZ  together  with  a  mapping  tt  that  associates  a  truth  assignment  with  the  primitive 
propositions  at  each  state  of  the  system. 

An  interpreted  plausibility  system  can  be  viewed  as  a  Kripke  structure  for  knowledge.  We 
say  two  points  (r,  m)  and  (r',  m')  are  indistinguishable  to  agent  i,  and  write  (r,  m)  (r',  m'), 
if  ri{m)  =  r'-{m'),  i.e.,  if  the  agent  has  the  same  local  state  at  both  points.  This  is  consistent 
with  the  intuition  that  an  agent’s  local  state  encodes  all  the  information  available  to  the 
agent.  Taking  to  dehne  the  /C*  relation,  we  get  a  Kripke  structure  over  points.  ® 

This  dehnition  of  knowledge  has  proved  useful  in  many  applications  in  distributed  systems 
and  AI  (see  [FHMV95]  and  the  references  therein).  As  argued  above,  we  want  to  add  the 

®  It  is  straightforward  to  extend  these  definitions  to  deal  with  continuous  time.  This  is  done,  for 
example,  in  [BLMS97]. 
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notion  of  plausibility  so  that  we  can  model  the  agent’s  beliefs.  It  is  straightforward  to  do 
so  by  adding  a  plausibility  assessment  for  each  agent  at  each  point.  Formally,  an  interpreted 
plausibility  system  is  a  tuple  X  =  (7l,n,Vi, . . .  ,Vn),  where  IZ  and  tt  are  as  before,  and 
the  plausibility  assignment  Vi  maps  each  point  (r, m)  to  a  plausibility  space  Vi{r,m)  = 
(hF(r,m,i))  Pl(r’,m,i))' 

In  order  to  reason  about  the  temporal  aspects  of  the  system,  we  add  to  the  language  temporal 
modalities  in  the  standard  fashion  (see  [GPSS80]).  These  include  Qcj)  for  “0  is  true  at  the 
next  time  step”  We  call  this  language  Evaluation  of  temporal  modalities  at  a  point 

(r,  m)  is  done  by  examining  the  future  points  on  the  run  r:  Given  a  point  (r,  m)  in  an 
interpreted  system  X,  we  have  that 

•  (X,  r,  m)  \=  00  if  (2i,  r,  m  +  1)  |=  0.  ® 

This  framework  is  clearly  a  temporal  extension  of  the  logic  of  knowledge  and  plausibility 
described  in  the  previous  section. 


3.2  Example:  Circuit  Diagnosis  Revisited 


We  now  show  how  the  framework  can  be  used  to  extend  the  example  of  Section  2.5  to 
incorporate  time,  allowing  the  agent  to  perform  a  sequence  of  tests. 

We  want  to  model  the  process  of  diagnosis.  That  is,  we  want  to  model  the  agent’s  beliefs  about 
the  circuit  while  it  performs  a  sequence  of  tests,  and  how  the  observations  at  each  step  affects 
her  beliefs.  Thus,  we  want  to  model  the  agent  and  the  circuit  as  part  of  a  system.  To  do  so,  we 
need  to  describe  the  agent’s  local  state  and  the  state  of  the  environment.  The  construction 
we  used  in  Section  2.5  provides  a  natural  division  between  the  two:  The  agent’s  state  is 
the  sequence  of  input-output  relations  observed,  while  the  environment’s  state  describes  the 
faulty  components  of  the  circuit  and  the  values  of  all  the  lines.  This  corresponds  to  our 
intuitions,  since  the  agent  can  observe  only  the  input-output  relations.  Each  run  describes 
the  results  of  a  specihc  series  of  tests  the  agent  performs  and  the  results  he  observes.  We  make 
two  additional  assumptions:  (1)  the  agent  does  not  forget  what  tests  were  performed  and  their 
results,  and  (2)  the  faults  are  persistent  and  do  not  change  over  time.  Formally,  we  dehne  the 
agent’s  state  ri(m)  to  be  (o(r^o),  ■  ■  ■ ,  0(r,m)},  where  0(r,m)  describes  the  input-output  relation 
observed  at  time  m.  We  define  the  environment  state  re(m)  =  {faultier,  m),  value{r,  m))  to  be 
the  failure  set  at  (r)  and  the  values  of  all  the  lines.  We  capture  the  assumption  that  faults  do 
not  change  by  requiring  that  faultier,  m)  =  faultier,  0).  The  system  TZ^iag  consists  of  all  runs 
r  satisfying  these  requirements  in  which  value  {r,m)  is  consistent  with  faultier,  m)  and  0(r,m) 
for  all  m. 

Given  the  system  TZdiag,  we  can  dehne  two  interpreted  plausibility  systems  corresponding 

®  It  is  easy  to  add  other  temporal  modalities  such  as  until,  eventually,  sinee,  etc.  These  do  not 
play  a  role  in  this  work. 


to  the  two  plausibility  measures  we  considered  in  Section  2.5.  In  both  systems,  hh(r,m,i)  = 
)Ci{r,m).  In  2diag,i,  we  compare  two  points  (ri,m)  and  (r2,m)  by  comparing  the  size  of 
fault{ri,m)  and  fault{r2,  m) ,  while  in  Tdiag,2  we  check  whether  one  failure  set  is  a  subset  of 
the  other.  At  a  point  (r,  m) ,  the  agent  considers  possible  all  the  points  where  he  performed 
the  same  tests  up  to  time  m  and  observed  the  same  results.  As  before,  the  agent  believes  that 
the  failure  set  is  one  of  the  minimal  explanations  of  his  observations.  As  the  agent  performs 
more  tests,  his  knowledge  increases  and  his  beliefs  might  change. 

We  dehne  Bel(X,  r,  m)  to  be  the  set  of  failure  sets  (i.e.,  diagnoses)  that  the  agent  considers 
possible  at  (r,  m).  Belief  change  in  Tdiag,i  is  characterized  by  the  following  proposition. 

Proposition  18  If  there  is  some  f  G  Bel{Idiag,i,r,m)  that  is  consistent  with  the  new  ob¬ 
servation  0(r,m+i),  then  Bel(Xdiag,i,r,  m  +  1)  consists  of  all  the  failure  sets  in  Bel(Xdiag,i,f', 
that  are  consistent  with  0(r,m+i)-  If  all  f  G  B{Idiag,i,r,m)  are  inconsistent  with  0(r,m+i);  then 
B{Tdiag,i)  r,  m  +  1)  consists  of  all  failure  sets  of  cardinality  j  that  are  consistent  with  0{r,m+i), 
where  j  is  the  least  cardinality  for  which  there  is  at  least  one  failure  set  consistent  with 

0(r,m+l)  • 


PROOF.  Straightforward;  left  to  the  reader.  □ 


Thus,  in  Tdiag,!,  a  new  observation  consistent  with  the  current  set  of  most  likely  explana¬ 
tions  reduces  this  set  (to  those  consistent  with  the  new  observation).  On  the  other  hand, 
a  surprising  observation  (one  inconsistent  with  the  current  set  of  most  likely  explanations) 
has  a  rather  drastic  effect.  It  easily  follows  from  Proposition  18  that  if  0(^r,m+i)  is  surpris¬ 
ing,  then  Be\(Xdiag,i,r,m)  fl  Be\(Xdiag,i,r,m  -|-  1)  =  0,  so  the  agent  discards  all  his  current 
explanations  in  this  case.  Moreover,  an  easy  induction  on  m  shows  that  if  Be\(Xdiag,i,r,  m)  fl 
Be\{Xdiag,i,T,m  -|-  1)  =  0,  then  the  cardinality  of  the  failure  sets  in  Be\{Xdiag,i)T,m  +  1)  is 
greater  than  the  cardinality  of  failure  sets  in  Be\{Xdiag,iiT,m).  Thus,  in  this  case,  the  expla¬ 
nations  in  Be\{Xdiag,i,T,m  -|-  1)  are  more  complicated  than  those  in  B{Idiag,i,r,m).  Notice 
that  if  we  can  characterize  the  observation  op,m+i)  in  our  language — that  is,  if  we  have  a 
formula  0  such  (X,  r',  m')  |=  0  if  and  only  if  0{^r',m')  =  0(r,m+i) — then  we  can  also  express  the 
fact  that  agent  i  considers  it  surprising:  This  is  true  precisely  if  {Idiag,i,r,m)  \=  Rj-iO0- 

Belief  change  in  Tdiag,2  is  quite  different,  as  the  following  proposition  shows.  Given  a  failure 
set  /,  we  dehne  ext{f)  =  {/'  :  /  C  /'}.  Thus,  ext{f)  consists  of  all  the  failure  sets  that 
extend  /. 

Proposition  19  Bel(Xdiag,2,f',^  +  1)  consists  of  the  minimal  (according  to  C)  failure  sets 
in  ^f(zBel{Jd-  consistent  with  0{r,m+i)- 


PROOF.  Straightforward;  left  to  the  reader.  □ 
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We  see  that,  as  with  Idiag,i,  failure  sets  that  are  consistent  with  the  new  observation  are 
retained.  However,  unlike  Tdiag,i,  failure  sets  that  are  discarded  are  replaced  by  more  com¬ 
plicated  failure  sets  even  if  some  of  the  explanations  considered  most  likely  at  (r,  m)  are 
consistent  with  the  new  observation.  Moreover,  while  new  failure  sets  in  Bel(Xrfjag  i,  r,m  +  l) 
can  be  unrelated  to  failure  sets  in  Be\(Xdiag,i,r,m),  in  Xdiag,2  the  new  failure  sets  must  be 
extensions  of  some  discarded  failure  sets.  Thus,  in  Tdiag,i  the  agent  does  not  consider  new 
failure  sets  as  long  as  the  observation  is  not  surprising.  On  the  other  hand,  in  Xdiag,2  the 
agent  has  to  examine  new  candidates  after  each  test.  The  latter  behavior  is  essentially  that 
described  by  Reiter  [Rei87,  Section  5]. 


3.3  Axiomatizing  the  Language  of  Knowledge,  Plausibility  and  Time 


We  now  present  sound  and  complete  axiomatization  for  the  language  The  technical 

details  are  much  in  the  spirit  of  the  results  of  Section  2.8,  with  two  exceptions.  First,  we 
need  to  deal  also  with  the  temporal  modality  O-  Second,  instead  of  dealing  with  worlds, 
we  are  dealing  with  systems  that  have  some  structure,  i.e.,  the  distinction  between  agents’ 
local  state  and  the  environment’s  state.  As  we  shall  see,  both  issues  can  be  dealt  with  in  a 
straightforward  manner. 

The  axiom  system  AX^  consists  of  the  axioms  and  rule  in  the  axiom  system  AX  of  Section  2.8 
and  the  following  axioms  and  rule  the  describe  the  properties  of  Q:. 

Tl. 

T2.  O0  = 

RTl.  From  (j)  infer  00- 

Let  C  be  the  set  of  all  plausibility  interpreted  systems. 

Theorem  20  The  axiom  system  AK^  is  a  sound  and  complete  axiomatization  of  with 

respect  to  C. 


PROOF.  See  Appendix  A. 3.  □ 


We  can  also  prove  a  result  analogous  to  Theorem  12  that  describes  a  complete  axiomatization 
for  the  classes  of  systems  satisfying  some  of  the  assumptions  we  examined  in  Section  2.4. 

Theorem  21  Let  A  be  a  subset  of  {RANK,  NORM,  REF,  UNIF,  CONS,  SDR}  and  let  A  be 
the  corresponding  subset  of  {05,  06,  07,  08,  09,  CIO}.  Then  AX^  U  A  is  a  sound  and 
complete  axiomatization  with  respect  to  systems  in  C  satisfying  A. 

PROOF.  See  Appendix  A. 3.  □ 
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4  Prior  Plausibilities 


The  formal  framework  of  knowledge,  plausibility  and  time  described  in  the  previous  section 
raises  a  serious  problem:  While  it  is  easy  to  see  where  the  relations  that  define  knowledge 
come  from,  the  same  cannot  be  said  for  the  plausibility  spaces  Vi{r,  m).  We  now  present  one 
possible  answer  to  this  question,  inspired  by  probability  theory. 

Up  to  now,  we  have  allowed  the  plausibility  assessment  at  each  point  to  be  almost  arbitrary. 
In  particular,  the  plausibility  space  Vi{r,m)  can  be  quite  different  from  Vi{r,m  +  1).  Typ¬ 
ically,  we  would  expect  there  to  be  some  relationship  between  these  successive  plausibility 
assessments.  For  example,  it  seems  reasonable  to  expect  that  the  new  plausibility  assessment 
should  incorporate  whatever  was  learned  at  (r,  but  otherwise  involve  minimal  changes 

from  Vi{r,  m). 

One  way  of  doing  this  in  probability  theory  is  by  conditioning.  If  we  start  with  a  probability 
function  Pr  and  observe  E,  where  Pr(F')  >  0,  then  the  conditional  probability  function  Pr^; 
is  defined  so  that  PrE(A)  =  Pr(ylni?)/ Pr(i?).  Typically  PiEiA)  is  denoted  Pr(A|U).  Notice 
that  Pr^  incorporates  the  new  information  E  by  giving  it  probability  1.  It  also  is  a  minimal 
change  from  Pr  in  the  sense  that  if  A,  i?  C  E,  then  Pr(A)/  Pr(i?)  =  Pi{A\E)/ Pi{B\E)\  the 
relative  probability  of  events  consistent  with  E  is  not  changed  by  conditioning. 

Conditioning  is  a  standard  technique  in  probability  theory,  and  can  be  justified  in  a  number 
of  ways,  one  of  which  is  the  notion  of  “minimal  change”  we  have  just  described.  Another 
justification  is  a  “Dutch  book”  argument  [Fin72,Ram31],  which  shows  that  if  an  agent  uses 
some  other  method  of  updating  probabilities,  then  it  is  possible  to  construct  a  betting  game 
in  which  he  will  always  lose.  Probability  measures  are  particular  instances  of  plausibility 
measures.  Can  we  generalize  the  notion  of  conditioning  to  plausibility  measures? 

It  immediately  follows  from  the  definitions  that  the  ordering  of  the  likelihood  of  events 
induced  by  Pr^;  is  determined  by  the  ordering  induced  by  Pr: 

Pr(A|i?)  <  Pt{B\E)  if  and  only  if  Pr(A  C)  E)  <  Pt{B  fl  E). 

We  want  the  analogous  property  for  plausibility: 

COND  PKAIC)  <  P\{B\C)  if  and  only  if  P1(A  C  C)  <  P1(R  C  C). 

This  rule  determines  the  order  induced  by  posterior  plausibilities.  Since  we  are  interested 
only  in  this  aspect  of  plausibility,  any  method  of  conditioning  that  satisfies  COND  will  do  for 

There  is  another  sense  in  which  Pr^;  represents  the  minimal  change  from  Pr.  If  we  measure  the 
“distance”  of  a  probability  distribution  Pp  from  Pr  in  terms  of  the  cross-entropy  of  Pp  relative 
to  Pr,  then  it  is  well  known  that  Pr^;  is  the  distribution  that  minimizes  the  relative  cross-entropy 
from  Pr  among  all  distributions  PP  such  that  Pp(£')  =  1  [KL51].  Indeed,  this  holds  true  for  other 
distance  measures  as  well  [DZ82]. 
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our  present  purposes.  (See  [FH95]  for  an  examination  of  other  properties  we  might  require  of 
conditioning.)  Notice  that  any  two  methods  for  conditioning  are  isomorphic  in  the  following 
sense:  Let  Si  =  {Wi,  Pli)  and  S2  =  {W21  PI2)  be  two  plausibility  spaces.  We  say  that  Si  and 
S2  are  (order)  isomorphic  if  there  is  a  bijection  h  from  Wi  to  W2  such  that,  for  A,B  Wi, 
we  have  Pli(A)  <  Pli(i?)  if  and  only  if  Pl2(h(A))  <  Pl2(h(i?)).  Any  two  dehnitions  of 
conditioning  that  satisfy  COND  result  in  order-isomorphic  plausibility  spaces  (see  [FH95]). 

This  discussion  suggests  that  we  dehne  Pl(r,m+i,j)  to  be  the  result  of  conditioning  Pl(r,m,i) 
on  the  new  knowledge  gained  by  agent  i  at  {r,m  +  1).  This,  however,  leads  to  the  following 
technical  problem.  If  the  agent  gains  new  knowledge  at  (r,  m  -|-  1),  then  rj(m)  7^  ri{m  -|-  1). 
This  implies  that  the  sets  of  points  the  agent  considers  possible  are  disjoint,  i.e.,  /Cj(r,  m)  fl 
)Ci{r,m  +  l)  =  0.  But  then  CONS  implies  that  Pl(r,m,i)  and  Pl(r,m+i,i)  are  dehned  over  disjoint 
spaces,  so  we  cannot  apply  COND. 

We  circumvent  this  difficulty  by  working  at  the  level  of  runs.  The  approach  we  propose 
resembles  the  Bayesian  approach  to  probabilities.  Bayesians  assume  that  agents  start  with 
priors  on  all  possible  events.  If  we  were  thinking  probabilistically,  we  could  imagine  the  agents 
in  a  multi-agent  system  starting  with  priors  on  the  runs  in  the  system.  Since  a  run  describes 
a  complete  history  over  time,  this  means  that  the  agents  are  putting  a  prior  probability 
on  the  sequences  of  events  that  could  happen.  We  would  then  expect  the  agent  to  modify 
his  prior  by  conditioning  on  whatever  information  he  has  learned.  This  is  essentially  the 
approach  taken  in  [HT93]  to  dehning  how  the  agents’  probability  distribution  changes  in  a 
multi-agent  system.  We  can  do  the  analogous  thing  with  plausibility. 

We  start  by  making  the  simplifying  assumption  that  we  are  dealing  with  synchronous  systems 
where  agents  have  perfect  recall  [HV89].  Intuitively,  this  means  that  the  agents  know  what  the 
time  is  and  do  not  forget  the  observations  they  have  made.  Formally,  a  system  is  synchronous 
if  for  any  i,  (r,  m)  (r',  m')  only  if  m  =  m' .  Notice  that  by  restricting  to  synchronous 
systems,  if  we  further  assume  that  the  plausibility  measure  Vi{r,  m)  satishes  CONS,  we  never 
have  to  compare  the  plausibilities  of  two  different  points  on  the  same  run.  In  synchronous 
systems,  agent  i  has  perfect  recall  if  (r',m-|-  1)  (r,  m-|-  1)  implies  {r)m)  {r,m).  Thus, 

agent  i  considers  run  r  possible  at  the  point  (r,  m  -|-  1)  only  if  he  also  considers  it  possible 
at  (r,  m).  This  means  that  any  runs  considered  impossible  at  (r,  m)  are  also  considered 
impossible  at  (r,  m  -|-  1);  an  agent  does  not  forget  what  he  knew. 

Just  as  with  probability,  we  assume  that  an  agent  has  a  prior  plausibility  measure  on  runs, 
that  describes  his  prior  assessment  on  the  possible  executions  of  the  system.  As  the  agent 
gains  knowledge,  he  updates  his  prior  by  conditioning.  More  precisely,  at  each  point  (r,  m), 
the  agent  conditions  his  previous  assessment  on  the  set  of  runs  considered  possible  at  (r,  m). 
This  is  process  is  shown  in  Figure  2.  This  results  in  an  updated  assessment  (posterior) 
of  the  plausibility  of  runs.  This  posterior  induces,  via  a  projection  from  runs  to  points,  a 
plausibility  measure  on  points.  We  can  think  of  agent  Fs  posterior  at  time  m  as  simply  his 
prior  conditioned  on  his  knowledge  at  time  m. 

To  make  this  precise,  let  S  =  (W,  PI)  be  a  plausibility  space.  Dehne  the  projection  of  S  on 
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Fig.  2.  Schematic  description  of  how  the  agent’s  knowledge  evolves  in  time  in  synchronous  systems 
with  perfect  recall.  The  boxes  represent  the  set  of  points  in  JCi{r,m).  Since  the  system  is  syn¬ 
chronous,  at  each  time  point,  the  agent  consider  possible  points  at  the  same  time.  Since  the  agent 
has  perfect  recall,  as  time  progresses,  the  agent  considers  smaller  and  smaller  sets  of  runs  possible. 
The  ovals  represent  two  disjoint  events  that  correspond  to  the  same  set  of  runs. 

E  as  S'Is  =  (bFl^;,  Pll^;),  where  W\e  =  W  D  E  and  Plj^;  is  the  restriction  of  PI  to  W\e- 
Projection  is  similar  to  conditioning:  for  any  dehnition  of  conditioning  that  satishes  COND 
a  A,  B  C  E,  then  F\{A\E)  <  F\{B\E)  if  and  only  if  P1|b(A)  <  P1|b(5).  Indeed,  S\e  is 
essentially  isomorphic  to  any  conditional  plausibility  measure  that  results  from  conditioning 
on  E. 

We  can  now  dehne  what  it  means  for  a  plausibility  measure  on  points  to  be  generated  by 
a  prior.  Suppose  that  agent  i’s  prior  plausibility  at  run  r  is  V(r,i)  =  Pl(r,i)),  where 

i)  ^  E..  Our  intuition  is  that  the  agent  conditions  the  prior  by  his  knowledge  at  time 
{r,m).  In  our  framework,  the  agent’s  knowledge  at  time  m  is  the  set  of  point  /Cj(r,  m).  We 
need  to  convert  this  set  of  points  to  an  event  in  terms  of  runs.  If  A  is  a  set  of  points,  we 
dehne  'R-{A)  =  {r  :  3m{{r,  m)  G  A)}  to  be  the  set  of  runs  on  which  the  points  in  A  lie.  Using 
this  notation,  the  set  of  runs  agent  i  considers  possible  at  (r,  m)  is  simply  lZ(JCi{r,  m)).  Thus, 
after  conditioning  on  this  set  of  runs,  we  get  agent  i’s  posterior  at  {r,m),  which  is  simply 
the  projection  of  the  prior  on  the  observation:  Pl(r,i)|-R,(jCi(r,m))-  We  now  use  this  plausibility 
measure,  which  is  a  measure  on  a  set  of  runs,  to  dehne  Vi{r,m),  which  is  a  measure  on  a 
set  of  points.  We  do  so  in  the  most  straightforward  way:  we  project  each  run  to  a  point 
that  lies  on  it.  Formally,  we  say  that  Vi{r,m)  is  the  time  m  projection  of  'P(r,i)\n{K.i{r,m)) 


To  make  this  precise,  we  need  a  notion  that  is  slightly  more  general  than  isomorphism.  Let 
P  =  {W,  Pr)  be  a  probability  space.  A  set  A  is  called  a  support  of  P  if  Pr(A)  =  0.  We  can 
define  a  similar  notion  for  plausibility  spaces.  Let  S  =  (IF,  PI)  be  a  plausibility  space.  We  say  that 
A  C  IF  is  a  support  of  S,  if  for  all  B  C  IF,  Pl(i?)  =  Fl{B  n  A).  Thus,  only  i?  n  A  is  relevant 
for  determining  the  plausibility  of  B.  This  certainly  implies  that  P1(A)  =  T,  since  we  must  have 
P1(A)  =  P1(A  n  A)  =  P1(0),  but  the  converse  does  not  hold  in  general.  In  probability  spaces, 
Pr(A)  =  0  implies  that  Pr(i?)  =  Pr(i?  fl  A)  for  all  B,  but  the  analogous  condition  does  not  hold 
for  arbitrary  plausibility  spaces.  We  say  that  two  plausibility  spaces  Si  and  S2  are  essentially 
(order)  isomorphic  if  there  are  supports  Ci  and  C2  of  Si  and  S2,  respectively,  such  that  5i|ci 
isomorphic  to  52|c2-  h-  is  easy  to  see  that,  as  expected,  essential  isomorphism  defines  an  equivalence 
relation  among  plausibility  spaces.  Finally,  it  is  easy  to  see  that  if  5  =  (IF, PI),  then  (IF, Pl(-|i?)) 
is  essentially  isomorphic  to  51^;  when  we  use  any  conditioning  method  that  satisfies  COND. 


33 


conditioning 


Prior  Evidence  Posterior 

Fig.  3.  Schematic  description  of  the  entities  involved  in  the  definition  of  priors.  Note  some  are 
defined  over  runs  and  some  over  points. 

if  Vi{r,m)  =  (lE(r,m,i),Pl(r,m,i)),  where  W(r,m,i)  =  {{r',m)  e  ICi{r,m)  :  r'  G  Tl{r,i)}  and  for 
all  A  C  W(r,m,i),  we  have  that  =  Pl(r,i)k(^i(r,m))(7^(d)).  Pl{r,m,i)  is  the  agent’s 

plausibility  measure  at  {r,m).  This  process  is  described  in  Figure  3.  The  main  complications 
are  due  to  the  transition  back  and  forth  between  entities  dehned  over  runs  and  ones  dehned 
over  points. 

We  remark  that  if  the  system  satishes  perfect  recall  as  well  as  synchrony,  our  original  intuition 
that  Vi{r,m  +  1)  should  be  the  result  of  conditioning  Vi{r,m)  on  the  knowledge  that  agent 
i  acquires  at  (r,  m  +  1)  can  be  captured  more  directly.  We  can  in  fact  construct  Vi{r,  m  +  1) 
from  Vi{r,  m)  by  what  can  be  viewed  as  conditioning  on  the  agent’s  new  information:  We  take 
Vi{r,  m)  and  project  it  one  time  step  forward  by  replacing  each  point  (r',  m)  by  (r',  m+1).  We 
then  condition  on  /Cj(r,  m  + 1)  (i.e.,  the  agent’s  knowledge  at  (r,  m  + 1))  to  get  'Pi(r,  m,  i  + 1). 

Proposition  22  Let  X  he  a  synchronous  system  satisfying  perfect  recall  such  that  Pl(r,m,i) 
is  the  time  m  projection  of  a  prior  Pl(r,i)  on  runs  for  all  runs  r,  times  m,  and  agents  i. 
Let  prev{A)  =  {(r, m)  :  (r, m  +  1)  G  A}.  Then  Plp,m+i)(^)  <  Pl(r-,m+i)(-B)  if  ond  only  if 
P\r,m){.P'oev{A))  <  P\(^r,m){.P'oev{B)) ,  for  all  runs  r,  times  m,  and  sets  A,B  E  hF(r,m+i)- 

PROOF.  Straightforward;  left  to  the  reader.  □ 


We  say  that  X  =  {TZ,  tt,  V)  satishes  PRIOR  if  X  is  synchronous  and  for  each  run  r  and  agent 
i  there  is  a  prior  plausibility  V(r,i)  such  that  for  all  m,  Vi{r,m)  is  the  time  m  projection  of 

P(r+- 

Example  23  It  is  easy  to  verify  that  the  two  systems  we  consider  in  Section  3.2  satisfy 
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PRIOR.  In  both  systems,  the  prior  V(r,i)  O  independent  of  the  run  r,  and  is  determined  by 
the  failure  set  in  eaeh  run. 

By  using  prior  plausibility  measures,  we  have  reduced  the  question  of  where  the  plausibility 
measure  at  each  point  comes  from  to  the  simpler  question  of  where  the  prior  comes  from. 
While  this  question  is  far  from  trivial,  it  is  analogous  to  a  question  that  needs  to  be  addressed 
by  anyone  using  a  Bayesian  approach.  Just  as  with  probability  theory,  in  many  applications 
there  is  a  natural  prior  (or  class  of  priors)  that  we  can  use. 

By  conditioning  on  plausibility  rather  than  probability,  we  can  deal  with  a  standard  problem 
in  the  Bayesian  approach,  that  of  conditioning  on  an  event  of  measure  0:  Notice  that  whenever 
a  prior  assigns  an  event  a  probability  measure  of  0  it  is  not  possible  to  condition  on  that 
event.  The  standard  solution  in  the  Bayesian  school  is  to  give  every  event  of  interest,  no 
matter  how  nnlikely,  a  small  positive  probability.  We  may  well  discover  that  a  formula  0 
that  we  believed  to  be  true,  i.e.,  one  that  was  true  in  all  the  most  plausible  worlds,  is  in  fact 
false.  Under  the  probabilistic  interpretation  of  plausibility,  this  means  that  we  are  essentially 
conditioning  on  an  event  of  measnre  0.  The  plausibility  approach  has  no  problem  with 
this:  the  conditioning  process  described  above  still  makes  perfect  sense. 


4.1  Conditioning  as  Minimal  Change  of  Belief 


In  this  section  we  examine  the  properties  of  conditioning  as  an  approach  to  minimal  change 
of  beliefs  and  relate  onr  approach  to  others  in  the  literatnre. 

Recall  that  QUAL  guarantees  that  belief  is  closed  nnder  logical  implication  and  conjunction 
(Theorem  4).  In  a  synchronous  system  where  the  prior  satishes  QUAL,  it  is  not  hard  to  see 
that  conditioning  preserves  QUAL.  Thus,  we  get  the  following  result. 

Proposition  24  Let  T  be  a  synchronous  system  satisfying  perfect  recall  and  PRIOR.  If  the 
prior  Pl(r,i)  satisfies  A2  for  all  runs  r  and  agents  i,  then  axiom  K2  is  valid  in  X  for  Bi. 


PROOF.  Straightforward;  left  to  the  reader.  □ 


This  result  shows  that  condition  A2  is  sufficient  to  get  beliefs  that  satisfy  K2.  Is  it  also 
necessary?  In  general,  the  answer  is  no.  However,  A2  is  the  most  natural  condition  that 
ensures  that  K2  is  satished.  To  see  this,  note  that  if  K2  is  valid  in  X  then  A2  holds  for  all 
pairwise  disjoint  snbsets  Ai,  A2  and  A3  of  points  in  X  dehnable  in  the  language  such  that 
IZ{JCi{r,m))  =  Ai  U  A2  U  A3  for  some  run  r,  agent  i,  and  time  m.  Thus,  if  we  assume  that 
the  language  is  rich  enough  so  that  all  subsets  of  X  are  dehnable  (in  that,  for  each  snbset  A 

Of  course,  this  requires  that  there  be  only  countably  many  events  of  interest. 
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and  agent  i,  there  is  a  formula  0  and  point  (r,m)  such  that  A  =  [0](r,m,i)),  then  K2  forces 
A2. 

In  view  of  this  discussion,  we  focus  in  this  section  on  synchronous  systems  with  a  qualitative 
prior. 

Next,  we  examine  how  changes  in  beliefs  are  determined  by  the  prior.  Using  Proposition  22, 
we  now  show  that  we  can  characterize,  within  our  language,  how  the  agent’s  beliefs  change 
via  conditioning,  provided  that  we  can  describe  in  the  language  what  knowledge  the  agent 
acquired.  We  say  that  a  formula  0  characterizes  agent  i  ’s  knowledge  at  (r,  m  +  1)  with  respect 
to  his  knowledge  at  (r,  m)  if,  for  all  (r',  m)  G  /Ci(r,  m),  we  have  (r',  m+1)  |=  0  if  and  only  if 
(r',  m  +  1)  G  /Cj(r,  m  +  1).  That  is,  among  the  points  that  succeed  points  that  are  considered 
possible  at  time  m,  exactly  these  satisfying  0  are  considered  possible  at  time  m  +  1.  Of 
course,  it  is  not  always  possible  to  characterize  the  agent’s  new  knowledge  by  a  formula  in 
our  language.  However,  in  many  applications  we  can  limit  our  attention  to  systems  where 
it  is  possible.  (This  is  the  case,  for  example,  in  our  treatment  of  revision  and  update  in 
[Fri97,FH97a].)  In  such  systems,  we  can  characterize  within  the  agent’s  belief  change  process 
in  the  language. 

Proposition  25  Let  T  he  a  synchronous  system  satisfying  perfect  recall  and  PRIOR.  If  0 
characterizes  agent  i’s  knowledge  at  {r,m  +  1)  with  respect  to  his  knowledge  at  {r,m),  then 
(J,  r,  m  +  1)  1=  0  ^  if  and  only  if  (J,  r,  m)  ^  0(0  A  0)  Qf. 

PROOF.  See  Appendix  A. 4.  □ 

Corollary  26  Let  X  he  a  synchronous  system  satisfying  perfect  recall  and  PRIOR.  If  0 
characterizes  agent  i’s  knowledge  at  {r,m  +  1)  with  respect  to  his  knowledge  at  {r,m),  then 
(X,r,m  +  1)  1=  Bifj  if  and  only  if  {I,r,m)  \=  Ki{Q(f)  ^  (O0  -^i  O'f’))-  Moreover,  if  I  also 
satisfies  SDP,  then  (X,  r,  m  +  1)  |=  Bifj  if  and  only  if  (X,  r,  m)  |=  00  00- 

We  now  use  this  result  to  relate  our  approach  to  other  approaches  for  modeling  conditionals 
in  the  literature.  Boutilier  [Bou92],  Goldszmidt  and  Pearl  [GP92],  and  Lamarre  and  Shoham 
[LS94]  give  conditional  statements  similar  semantics  (using  a  preference  ordering),  but  0  — >  0 
is  read  “after  learning  0,  0  is  believed”.  Two  crucial  assumptions  are  made  in  these  papers. 
The  hrst  is  that  the  agent  considers  only  one  plausibility  assessment,  which  in  our  terminology 
amounts  to  SDP.  The  second  is  that  propositions  are  static,  i.e.,  their  truth  value  does  not 
change  along  a  run.  Formally,  a  system  is  static  if  7r(r(m))  =  7r(r(0))  for  all  runs  r  and 
times  m.  This  implies  that  for  any  propositional  formula  0,  we  have  that  0  =  O0-  These 
two  assumptions  lead  to  a  characterization  of  belief  change. 

Corollary  27  Let  X  he  a  synchronous  static  system  satisfying  PRIOR,  SDP,  and  perfect 
recall,  and  let  0  and  0  he  propositional  formulas.  If  0  characterizes  agent  i ’s  knowledge  at 

This  assumption  is  only  implicit,  since  none  of  these  papers  have  an  explicit  representation  of 
time.  Nevertheless,  it  is  clear  that  this  assumption  is  being  made. 
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(r,  m  +  1)  with  respect  to  his  knowledge  at  {r,m),  then  (2,r,m  +  1)  |=  Bi'ip  if  and  only  if 
\=  ^jJ. 

While  this  result  shows  that,  in  certain  contexts,  there  is  a  connection  between  a  statement 
such  as  “typically  0’s  are  ^’s”  (which  is  how  we  have  between  interpreting  0  if)  and  “after 
learning  0,  if  is  believed”  (which  is  how  it  is  interpreted  in  [Bou92,GP92,LS94]),  the  two 
readings  are  in  general  quite  different.  For  one  thing,  notice  that  Corollary  27  assumes  that  0 
and  if  are  propositional  formulas.  This  is  a  necessary  assumption.  If  0  and  if  contain  modal 
formulas,  then  (f  ^  if  does  not  necessarily  imply  that  the  agent  believes  if  at  the  next  time 
step.  For  example,  if  (X,  r,  m)  \=  Biif,  then  for  any  formula  0,  we  have  (X,  r,  m)  \=  0  — Biif, 
regardless  of  whether  Biif  is  believed  at  (r,  m  +  1).  In  [FH94b],  we  examine  conditionals  of 
the  form  (f  >  if  intended  to  capture  the  second  interpretation  ^^if  is  believed  after  learning 
0”.  The  semantics  for  these  conditionals  involves  examining  future  time  points,  just  as  our 
intuitive  reading  dictates.  As  we  have  just  seen,  >  and  — are  quite  different  when  we  consider 
modal  formulas  in  the  scope  of  these  conditionals. 

This  discussion  shows  one  of  the  benehts  of  representing  time  explicitly.  In  our  framework 
we  can  distinguish  between  agents’  plausibility  assessment  and  their  belief  dynamics.  Of 
course,  we  would  like  agents  to  be  persistent  in  their  assessment,  which  is  exactly  what 
conditioning  captures.  In  the  presence  of  several  assumptions,  we  get  a  close  connection 
between  agents’  conditional  beliefs  and  how  their  beliefs  change.  This  allows  us  to  identify 
some  of  the  assumptions  implicitly  made  in  previous  approaches.  For  example,  all  of  the 
approaches  we  mentioned  above  would  not  apply  when  we  consider  a  changing  environment, 
since  they  cannot  reason  about  how  the  environment  changes  between  one  time  point  and 
the  next. 

Finally,  we  examine  the  work  of  Battigalli  and  Bonanno  [BB97].  They  consider  a  logic  of 
knowledge,  belief,  and  time,  and  attempt  to  capture  properties  of  “minimal  change”  of  beliefs. 
Their  language  is  slightly  different  from  ours.  Instead  of  introducing  a  temporal  modality, 
they  dehne  a  different  belief  and  knowledge  modality  for  each  time  step:  B^cf  reads  “the 
agent  believes  0  at  time  f” .  Battigalli  and  Bonanno  also  assume  that  propositions  are  static 
and  do  not  change  in  time.  Thus,  the  only  changes  are  in  terms  of  the  agent’s  knowledge 
and  belief.  Battigalli  and  Bonanno  propose  an  axiom  system  similar  to  the  axioms  of  Kraus 
and  Lehmann  (that  is,  they  use  K5  for  knowledge  is  K5,  KD45  for  belief,  and  take  axioms 
KBl  and  KB2  of  Section  2.7  to  characterize  the  connection  between  knowledge  and  belief) 
that  also  includes  two  additional  axioms  that  can  be  written  in  our  language  as 

BTl.  BiQBicf  Bi(f 
BT2.  Bi(f  ^  BiOBi(f 

Battigalli  and  Bonanno  claim  that  these  axioms  capture  the  principle  that  the  agent  does 
not  change  her  mind  unless  new  knowledge  forces  her  to  do  so.  Intuitively,  this  principle 
also  applies  to  conditioning,  and  thus  it  is  instructive  to  understand  when  these  axioms  are 
satished  in  our  framework. 
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It  turns  out  that  RANK  combined  with  a  minimal  assumption  implies  both  BTl  and  BT2. 
We  say  that  a  system  has  finite  branching  if  it  allows  only  hnitely  many  “branches”  at  each 
local  state  of  an  agent  (that  is  there  are  only  hnitely  many  observations  that  an  agent  can 
make  at  each  point). 

Lemma  28  Let  T  he  a  synchronous  static  system  satisfying  PRIOR,  RANK,  SDR,  and 
perfect  recall  that  has  finite  branching.  Then  (X,  r,  m)  \=  Bifi  BiQBifi  for  all  propositional 
formulas  fi. 


PROOF.  See  Appendix  A. 4.  □ 


Are  these  conditions  necessary  to  characterize  BTl  and  BT2?  The  answer  is  no.  First,  the 
proof  of  Lemma  28  applies  to  systems  with  inhnite  branching,  if  the  agents’  prior  satishes 
an  inhnitary  version  of  A2.  As  shown  in  [FHK96],  this  inhnitary  version  is  satished  by 
K-rankings  and  preference  orderings  that  are  well  founded  (that  is,  they  have  no  inhnite 
descending  sequences  ■■■  -<  -<  W2  -<  Wi).  Thus,  any  system  with  static  propositions 

whose  prior  is  induced  by  a  well-founded  preference  order  satishes  BTl  and  BT2.  Note  that 
BTl  and  BT2  do  not  characterize  RANK,  since  they  put  restrictions  only  on  certain  events 
(ones  dehnable  by  a  conjunction  of  a  formula  and  the  agent’s  new  knowledge  at  some  time 
point).  However,  RANK  is  the  most  natural  restriction  that  implies  these  axioms. 

Thus,  we  see  that  Battigalli  and  Bonanno  essentially  require  systems  with  minimal  change 
to  satisfy  conditioning  with  a  prior  that  is  a  ranking.  As  we  shall  see  in  the  next  section, 
similar  requirements  are  made  by  the  AGM  formulation  of  belief  revision  [AGM85] . 


4-2  Properties  of  Prior  Plausibilities 


If  we  take  the  plausibilities  in  a  system  to  be  generated  by  a  prior,  then  many  of  the  conditions 
we  are  interested  in,  such  as  QUAL  and  REF,  can  be  viewed  as  being  as  being  induced 
by  the  analogous  property  on  the  prior.  We  have  considered  these  properties  only  in  the 
context  of  Kripke  structures  for  knowledge  and  probability,  so  to  make  sense  of  the  prior 
having  the  “analogous  property”,  we  have  to  be  able  to  view  the  set  of  runs  as  a  Kripke 
structure  for  knowledge  and  probability.  Let  X  be  a  synchronous  system  satisfying  perfect 
recall  and  PRIOR.  Dehne  Mj  =  {IZ,  tt”,  . . . ,  /C”,  Vfi  . . . ,  Vf),  where  tt”  is  an  arbitrary 
truth  assignment,  Kf  is  the  full  relation,  i.e.,  TZxIZ,  and  Vlfi-)  =  V(r,i),  the  prior  of  agent  i 
at  run  r. 

Proposition  29  LetX  be  a  synchronous  system  satisfying  perfect  recall  and  PRIOR.  If  Mj 
satisfies  QUAL,  REF,  SDP,  UNIF  or  RANK,  then  so  doesX. 

PROOF.  Straightforward;  left  to  the  reader.  □ 
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Thus,  by  constructing  priors  that  satisfy  various  properties,  we  can  ensure  that  the  resulting 
system  also  satisfies  them.  In  particular.  Proposition  29  implies  that  if  V{r,i)  is  independent 
of  r,  so  that  agent  i’s  prior  is  independent  of  the  run  he  is  in,  then  X  satishes  SDP.  A 
somewhat  weaker  assumption — that  the  set  of  runs  can  be  partitioned  into  disjoint  subsets 
such  that  for  r, r'  G  IZj,  we  have  V{r,i)  =  — ensures  that  X 

satishes  UNIF.  Intuitively,  the  sets  TZj  correspond  to  different  settings  of  parameters.  Once 
we  set  the  parameters,  then  we  hx  the  plausibility  measure  (and  it  is  the  same  at  all  runs 
that  have  the  same  setting  of  the  parameters). 

We  conclude  this  section  by  examining  whether  assuming  conditioning  limits  the  expres¬ 
siveness  of  our  belief  change  operation.  A  well-known  result  of  Diaconis  and  Zabell  [DZ82] 
that  shows  that,  in  a  precise  sense,  any  form  of  coherent  probabilistic  belief  change  can  be 
described  by  conditioning.  In  particular,  they  show  that,  given  two  probability  distributions 
Pr  and  Ph  on  a  hnite  space  W  that  are  coherent  in  the  sense  that  Pr(A)  =  0  implies  that 
Pr'(A)  =  0,  there  is  a  space  W*  of  the  form  W  x  X,  a  subset  E  of  hF*,  and  a  distribution 
Pr"  on  W*  such  that,  for  all  A  C  hF,  we  have  Pr"(A  x  X)  =  Pr(A)  (so  that  Pr"  can  be 
viewed  as  an  extension  of  Pr)  and  Pr'(A)  =  Pr"(A  x  X\E). 

We  can  prove  a  result  in  a  somewhat  similar  spirit  in  our  framework.  The  hrst  step  is  to 
dehne  a  plausibilistic  analogue  of  coherence  in  systems. 

Let  X  be  a  synchronous  system.  We  say  that  X  is  coherent  if  the  following  condition  is 
satished  for  all  r  and  m:  Suppose  R  C  hFp,m,i),  =  Rf]  7^(hF(r,m,i)),  C 

kF(r,m+i,i),  and  7^(A™+^)  =  Rn  7^(hFp,,„+l,p).  If  P\r, m,i){A'^)  =  T,  then  P\r,m+i,i){A'^^^)  = 
T.  Despite  the  different  formulation,  this  condition  is  analogous  to  the  probabilistic  coherence 
of  Diaconis  and  Zabell.  Roughly  speaking,  if  a  set  of  runs  has  plausibility  T  (which  is 
analogous  to  probability  0  for  Diaconis  and  Zabell)  at  time  m,  then  it  is  required  to  have 
plausibility  T  at  time  m  -|-  1.  More  precisely,  coherence  of  a  system  ensures  that  sets  of  runs 
that  were  considered  implausible  at  (r,  m),  either  by  being  outside  or  by  being  given 

plausibility  are  also  considered  implausible  at  (r,  m  -|-  1).  Note,  this  condition  does 

not  put  any  constraints  on  how  the  runs  that  are  considered  possible  are  ordered.  It  is  easy 
to  verify  that  the  following  axiom  is  valid  in  coherent  systems: 

COH.  WO0  ^  ONi(j) 

Proposition  30  If  I  is  a  synchronous  and  coherent  system,  then  COH  is  valid  in  X. 


PROOF.  Straightforward;  left  to  the  reader.  □ 


There  is  a  sense  in  which  the  converse  to  Proposition  30  holds  as  well:  Given  a  synchronous 
system  that  is  not  coherent,  we  can  dehne  a  truth  assignment  tt  in  this  system  for  which 
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COH  does  not  hold. 


It  is  easy  to  see  that  coherence  is  a  necessary  condition  for  satisfying  PRIOR. 

Proposition  31  If  I  is  a  synchronous  system  satisfying  perfect  recall  and  PRIOR,  then  X 
is  coherent. 


PROOF.  Straightforward;  left  to  the  reader.  □ 


Thus,  PRIOR  forces  systems  to  be  coherent,  and  hence  to  satisfy  COH.  It  also  forces  systems 
to  satisfy  CONS,  and  hence  C5.  As  we  shall  see,  it  also  forces  some  other  semantic  properties. 
Nevertheless,  we  can  show  that  for  coherent  systems  that  satisfy  CONS,  PRIOR  does  not 
force  any  additional  properties,  by  proving  an  analogue  to  the  Diaconis  and  Zabell  result  in 
our  framework. 

We  say  that  a  formula  0  G  is  temporally  linear  if  temporal  modalities  in  0  do  not 

appear  in  the  scope  of  the  JCi  or  -^i  modalities.  Thus,  for  example,  a  formula  such  as 
(0  — f))  ^  OBifj  is  temporally  linear,  while  Ki{Q(f)  — O'lp)  QBifj  is  not.  Temporal 
linearity  ensures  that  all  the  temporal  connectives  in  0  are  evaluated  with  respect  to  a  single 
run.  The  following  result  says  that,  at  least  for  temporally  linear  formulas,  we  can  view  belief 
change  in  a  coherent  system  X  as  coming  from  conditioning  on  a  prior,  in  the  sense  that  we 
can  embed  X  into  a  larger  system  where  this  is  the  case. 

Theorem  32  Let  A  be  a  subset  of  {QUAL,  NORM,  REF,  RANK}  and  let  X  be  a  coherent 
synchronous  system  satisfying  perfect  recall,  CONS,  and  A.  Then  there  is  a  synchronous 
system  X'  satisfying  perfect  recall,  PRIOR,  and  A,  and  a  mapping  f  ■.  IZ  ^  IZ'  such  that  for 
all  temporally  linear  formulas  (f)  G  ,  we  have  {X,  r,  m)  |=  0  if  and  only  if  (X',  f{r),m)  |= 


PROOF.  See  Appendix  A. 5.  □ 


Notice  that  formulas  that  just  compare  an  agent’s  beliefs  (or  knowledge)  at  successive  time 
points  are  temporally  linear.  All  the  ACM  postulates  and  the  KM  postulates  (when  trans¬ 
lated  to  our  language)  are  of  this  form.  Not  surprisingly,  as  we  show  in  [Fri97,FH97a],  these 
postulates  can  be  captured  by  systems  with  the  appropriate  prior  plausibility. 

We  remark  that  COH  is  analogous  to  the  axiom  Ki(f)4>  (f)IAi4>  that  characterizes  perfect  recall 
in  synchronous  systems  [FHMV95].  Roughly  speaking,  this  is  because  coherence  ensures  that  the 
agent  does  not  forget  what  she  ruled  out  as  implausible. 

We  note  that  this  result  is,  in  a  sense,  stronger  than  Diaconis  and  Zabell’s.  They  examine  only 
the  probability  of  events,  which  are  essentially  propositional  formulas  (i.e.,  formulas  without  modal 
operators). 
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Can  we  extend  Theorem  32  to  the  full  language?  We  conjecture  that  Theorem  32  actually 
holds  for  all  0  G  not  just  temporally  linear  formulas.  This  conjecture  implies  that  a 

formula  is  valid  with  respect  to  synchronous  systems  satisfying  perfect  recall,  CONS,  and 
PRIOR  if  and  only  if  it  is  valid  with  respect  to  synchronous  coherent  systems  satisfying 
CONS  and  perfect  recall.  That  is,  except  for  COH  and  C9,  we  do  not  get  any  new  properties 
by  assuming  PRIOR  and  CONS. 

Note  that  the  construction  described  by  Theorem  32  does  not  necessarily  preserve  SDP  or 
UNIF  in  the  transformation  from  X  to  X'.  This  is  due  to  the  fact  that  in  the  presence  of  SDP 
or  UNIF,  PRIOR  forces  new  semantic  properties.  Recall  that  UNIF  implies  that  there  is  a 
partition  of  possible  points  such  that  two  points  (r,  m)  and  (r',  m')  are  in  the  same  cell  if  and 
only  if  Vi{r,m)  =  Vi{r\m').  Let  PERSIST  be  the  requirement  that  this  partition  changes 
minimally  in  time.  More  precisely,  we  say  that  a  system  satishes  PERSIST  if  for  all  runs 
r,  r'  G  7?.  and  m  such  that  (r,  m  + 1)  (r',  m  + 1),  we  have  that  Xj(r,  m  + 1)  =  Xj(r',  m  + 1)  if 

and  only  if  Vi{r,m)  =  Vi{r',m).  Intuitively,  PERSIST  (in  the  presence  of  synchrony,  perfect 
recall,  and  CONS)  implies  that  the  partition  of  points  at  time  m  +  1  is  determined  by  the 
partition  of  corresponding  points  at  time  m  and  the  knowledge  relation  at  time  m  +  1. 

Proposition  33  //X  is  a  synchronous  system  that  satisfies  perfect  recall  and  either  PRIOR 
and  UNIF,  or  SDP,  then  X  satisfies  PERSIST. 


PROOF.  Straightforward;  left  to  the  reader.  □ 


It  is  not  clear  to  us  at  this  stage  whether  PERSIST  forces  new  properties  in  our  language. 
However,  if  we  assume  that  PERSIST  holds,  we  can  get  a  result  analogous  to  Theorem  32. 

Theorem  34  Let  A  be  a  subset  of  {QUAL,  NORM,  REF,  SDP,  UNIF,  RANK]  and  let  X 
be  a  coherent  synchronous  system  satisfying  perfect  recall,  CONS,  PERSIST,  and  A.  Then 
there  is  a  synchronous  system  X'  satisfying  perfect  recall,  PRIOR,  and  A,  and  a  mapping 
f  -.IZ  ^  IZ'  such  that  for  all  temporally  linear  formulas  G  ,  (X,  r,m)  \=  if  and  only 
if  1=  0. 


PROOF.  See  Appendix  A. 5.  □ 


Thus,  the  question  of  whether  PRIOR  forces  new  properties  in  the  presence  of  UNIF  re¬ 
duces  to  the  question  of  whether  PERSIST  forces  new  properties.  Finally,  since  SDP  implies 
PERSIST,  PRIOR  does  not  force  new  properties  in  the  presence  of  SDP. 

Our  discussion  of  conditioning  and  priors  up  to  now  assumed  synchrony  and  perfect  recall. 
Can  we  make  sense  of  conditioning  when  we  relax  these  assumptions?  Note  that  the  dehnition 
of  PRIOR  does  not  rely  on  perfect  recall.  PRIOR  is  well  dehned  even  in  systems  where 
agents  can  forget.  However,  in  such  systems,  the  intuitions  that  motivated  the  use  of  PRIOR 
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are  no  longer  valid.  In  particular,  PRIOR  does  not  imply  coherence  and  the  analogue  to 
Proposition  22  does  not  hold:  we  no  longer  can  construct  Vi{r,m  +  1)  from  Vi{r,m)  since 
runs  that  are  considered  impossible  at  time  m  might  be  considered  possible  at  time  m  +  1.^^ 
Dropping  the  assumption  of  synchrony  also  leads  to  problems,  even  in  the  presence  of  perfect 
recall.  In  an  asynchronous  setting,  an  agent  might  consider  several  points  on  the  same  run 
possible.  The  question  then  arises  as  to  how  (or  whether)  we  should  distribute  the  plausibility 
of  a  run  over  these  points.  Two  approaches  are  considered  in  a  probabilistic  setting  in  [PR97], 
in  the  context  of  analyzing  games  with  imperfect  recall.  It  would  be  of  interest  to  see  to  what 
extent  these  approaches  can  be  carried  over  to  the  plausibilistic  setting. 


5  Conclusion 


We  have  proposed  a  framework  for  belief  dynamics  that  combines  knowledge,  time,  and 
plausibility  (and  hence  beliefs),  and  investigated  a  number  of  properties  of  the  framework, 
such  as  complete  axiomatizations  for  various  sublanguages  and  various  properties  of  the 
relationships  between  the  modal  operators.  Of  course,  the  obvious  question  is  why  we  should 
consider  this  framework  at  all. 

There  are  two  features  that  distinguish  our  approach  from  others.  The  first  is  that  we  use 
plausibility  to  model  uncertainty,  rather  than  other  approaches  that  have  been  mentioned  in 
the  literature,  such  as  preference  orderings  on  worlds  or  e-semantics.  The  second  is  that  we 
include  knowledge  and  time,  as  well  as  belief,  explicitly  in  the  framework. 

We  could  have  easily  modihed  the  framework  to  use  other  ways  of  modeling  uncertainty. 
Indeed,  in  a  preliminary  version  of  this  paper  [FH94c],  we  used  preference  orderings.  We  have 
chosen  to  use  plausibility  measures  for  several  reasons.  First,  plausibility  measures  generalize 
all  approaches  to  representing  uncertainty  that  we  are  aware  of.  The  use  of  plausibility  makes 
it  easier  to  compare  our  approach,  not  only  to  preference-based  approaches  (e.g.,  [Bou92]), 
but  also  to  approaches  based  on  /t-rankings  (e.g.,  [GP92]),  probably  measures  (e.g.,  [HT93]), 
or  any  other  measure  of  uncertainty.  More  importantly,  it  makes  it  easier  for  us  to  incorporate 
intuitions  from  other  approaches.  We  have  already  seen  one  example  of  this  phenomenon 
in  the  present  paper:  we  dehned  a  plausibilistic  analogue  of  conditioning,  and  used  it  to 
model  minimal  change.  As  we  show  in  [FII97a],  we  can  represent  the  standard  approaches  to 
minimal  change — belief  revision  and  belief  update — in  terms  of  conditioning.  Moreover,  the 
semantic  characterization  of  conditioning  should  allow  us  to  apply  it  more  easily  to  deal  with 
complications  that  arise  when  the  language  lets  us  reason  about  multiple  agents,  actions, 
and  beliefs  about  beliefs.  Another  example  of  adopting  probabilistic  intuitions  is  given  in 
[Fri97,FH95,FH96b],  where  plausibilistic  analogues  of  independence  and  Markov  chains  are 
described  and  used  to  dehne  a  novel  approach  to  belief  change.  We  believe  that  these  notions 
will  have  applications  elsewhere  as  well.  Finally,  plausibility  measures  have  the  advantage  of 

We  could,  of  course,  redefine  PRIOR  so  as  to  guarantee  that  Proposition  22  holds,  but  this  leads 
to  other  complications. 
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greater  expressive  power  than  other  approaches.  For  example,  work  on  defaults  has  mainly 
focused  on  properties  of  structures  with  a  hnite  number  of  worlds.  In  our  framework,  however, 
even  a  simple  system  with  two  global  states  might  have  an  uncountable  number  of  runs. 
As  shown  in  [FHK96],  once  we  examine  structures  with  inhnitely  many  worlds,  qualitative 
plausibility  measures  can  capture  natural  ordering  of  events  that  cannot  be  captured  by 
preference  orderings,  possibility  measures,  or  ^-rankings. 


As  we  have  tried  to  argue  throughout  the  paper,  the  explicit  representation  of  knowledge  and 
time  makes  it  much  easier  to  study  belief  dynamics.  Most  current  work  in  the  area  examines 
only  the  beliefs  of  an  agent  and  how  they  change  after  incorporating  a  new  belief.  Many 
simplifying  assumptions  are  made:  that  there  is  a  single  agent,  that  the  agent’s  knowledge 
does  not  change,  that  new  information  can  be  characterized  in  the  language,  and  so  on. 
It  is  useful  to  study  this  simple  setting  in  order  to  get  at  the  basic  issues  of  belief  change. 
However,  these  simplifying  assumptions  are  not  suitable  when  we  want  examine  belief  change 
in  more  realistic  settings  (such  as  the  diagnosis  example  of  Section  3.2).  This  means  that 
most  of  the  results  in  the  current  belief  change  literature  are  not  directly  applicable  in  many 
standard  AI  problems.  Our  framework  dispenses  with  most  of  the  simplifying  assumptions 
made  in  the  literature,  and  thus  can  be  viewed  as  a  hrst  step  towards  providing  a  model  of 
more  realistic  settings  of  belief  change. 


We  have  focused  here  on  the  foundations  of  the  framework.  In  the  future,  we  hope  to  apply 
the  framework  to  examine  more  realistic  problems.  We  have  already  begun  to  do  this.  For 
example,  in  [FH94c]  we  provide  a  detailed  analysis  of  iterated  prisoner  dilemma  games  be¬ 
tween  two  agents.  It  is  well-known  that  the  players  cannot  cooperate  when  they  have  common 
knowledge  of  rationality.  However,  we  show  that  they  can  cooperate  when  they  have  com¬ 
mon  belief  of  rationality.  A  recent  proposal  by  van  der  Meyden  [Mey94]  for  multi-agent  belief 
change  can  easily  be  embedded  in  our  framework  [van94].  We  hope  to  use  our  framework  to 
study  some  of  the  problems  considered  by  van  der  Meyden,  such  as  speech-act  semantics. 
Another  natural  application  area  is  reasoning  about  actions  and  planning  in  the  presence  of 
uncertainty.  We  believe  that  the  flexibility  and  expressive  power  of  the  framework  will  help 
to  clarify  what  is  going  on  in  all  these  areas. 
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A  Proofs 


A.l  Proofs  for  Section  2.1 


Theorem  7:  K  (resp.,  Kf5,  KD45)  is  a  sound  and  complete  axiomatization  for  with 
respect  to  Ai  (resp.,  cons, norm 


PROOF.  As  usual,  soundness  is  straightforward,  so  we  focus  on  completeness.  We  prove 
completeness  by  showing  that  for  M  G  M.k  (resp.  Af^*)  there  is  a  structure  G  M. 
(resp.  such  that  for  all  0  G  ,  we  have  {M,w)  |=  0  if  and  only  if 

{M~^,w)  1=  0.  Completeness  then  follows  from  Theorem  1. 

Let  M  =  (IT,  . . . ,  Bn)  be  a  Kripke  structure  for  belief.  We  construct  a  Kripke  struc¬ 
ture  for  knowledge  and  plausibility  =  (W,  tt,  Ai, . . . ,  Pi, . . . ,  Pn)  as  follows.  We 
set  K,i{w)  to  be  the  set  of  worlds  where  agent  i’s  beliefs  are  the  same  as  in  w.  Formally, 
{w,  v)  G  ICi  if  Bi{w)  =  Biiy).  It  is  easy  to  verify  that  A*  is  an  equivalence  relation.  We  dehne 
Viiw)  =  (W(^n},i),  Pl(«),i)),  where  W(w,i)  =  is  the  set  of  worlds  agent  i  considers  possible, 

Pl(«),i)(0)  =  0)  and  Pl(u,^j)(A)  is  1  if  A  C  lT(^^q  is  not  empty  It  is  easy  to  verify  that  these 
(trivial)  plausibility  measures  are  qualitative. 

We  now  prove  that  {M,w)  \=  0  if  and  only  {M~^,w)  \=  0  for  any  0  G  .  This  is  shown 
by  induction  on  the  structure  of  0.  The  only  interesting  case  is  if  0  is  of  the  form  Pj0'. 
Assume  {M,w)  \=  Bicf'.  We  want  to  show  that  \=  Ki{true  — 0').  We  start  by 

noting  that  {w,v)  G  ICi  if  and  only  if  R(u)  =  Bi{w).  This  implies  that  Vi{v)  =  Vi{w).  Thus, 
,v)  1=  true  — 0'  if  and  only  if  \=  true  — 0'.  Thus,  it  suffices  to  show  that 

1=  true  — 0',  since  this  implies  that  \=  Ki{true  0'),  i.e.,  \= 

Bi(f)'.  There  are  two  cases.  If  Bi{w)  =  0,  then  =  0.  This  implies  that  true  0' 

holds  vacuously.  If  Bi{w)  is  not  empty,  then  using  the  induction  hypothesis  we  conclude  that 
[0l(t«,i)  =  Biiw).  From  the  dehnition  of  Pl(u,^j)  we  conclude  that  Pl(^^j)([0'](^^j))  =  1  and  that 
Pl(«),i)([“'0l(«),i))  =  0.  Thus,  {M^,w)  1=  true  0'  and  hence  {M^,w)  \=  Ki{true  -^i  0'). 
Now  assume  {M,w)  \=  -^Bicf'.  Then  there  is  some  v  G  Bi{w)  such  that  {M,v)  \=  ->0'. 
Using  the  induction  hypothesis  we  conclude  that  Pl(«,,i)([“'0'](u,,i))  =  1.  Hence,  \= 

-^{true  -^i  0')  and  therefore,  ,w)  \=  ^Ki{true  — 0'). 

It  remains  to  show  that  if  M  G  AI|^  then  satishes  CONS,  and  if  M  G  Alf^*,  then 
also  satishes  NORM.  Assume  Bi  is  transitive  and  Euclidean.  Let  w  and  v  be  worlds  such 
that  {w,v)  G  Bi.  We  claim  that  Bi{w)  =  Biiy).  If  iw,t)  G  Bi,  then  since  Bi  is  Euclidean  we 
get  that  (u,t)  G  Bi.  If  (u,t)  G  Bi,  then  since  Bi  is  transitive  we  get  that  iw,t)  G  H*.  Thus, 
Biiv)  =  Biiw),  as  desired.  Recall  that  if  R(u)  =  Biiw),  then  our  construction  ensures  that 
V  G  ICiiw).  Hence,  Biiw)  C  Ai(tc)  and  M+  satishes  CONS.  Assume  that  R  is  serial.  This 
implies  that  for  all  w,  Biiw)  is  not  empty.  Thus,  our  construction  guarantees  that  IF(^,i)  is 
not  empty  and  Pl(^,i)(IF(u,,i))  >T.  □ 
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Theorem  8:  (resp.,  ^j^KB,coNS,NORMj  ^  sound  and  complete  axiom- 

atization  of  with  respect  to  M  (resp.,  ^coNS,NORMj^ 


PROOF.  Again  soundness  is  straightforward,  so  we  focus  on  completeness.  We  sketch  a 
completeness  proof  following  the  usual  Makinson  [Mak66]  style  of  proof.  We  describe  only 
the  parts  that  are  different  from  the  standard  proofs.  See,  for  example,  Halpern  and  Moses 
[HM92]  for  details. 

In  order  to  prove  completeness,  we  need  only  show  that  if  the  formula  (j)  is  consistent  with  the 
axiom  system  (i.e.,  AX™,  or  then  0  is  satishable  in  a  Kripke 

structure  of  the  appropriate  class  (i.e.,  Ai,  or  respectively). 

Let  F  be  a  set  of  formulas  and  AX  an  axiom  system.  We  say  that  V  is  AX-consistent  if  for 

all  01, ...  0^  G  V,  it  is  not  the  case  that  AX  I - i(0i  A  ...  A  0„).  The  set  F  is  a  maximal 

consistent  set  if  it  is  consistent,  and  for  each  formula  0,  either  0  G  F  or  -i0  G  V. 

We  now  build  a  canonical  model  for  AX^®,  in  which  every  AX^^-consistent  formula  is 
satishable.  has  a  world  wy  corresponding  to  every  maximal  AX^^-consistent  set  V  of 

formulas;  we  show  that  {M^^,wv)  \=  (f  ii  and  only  if  0  G  F. 

We  proceed  as  follows.  If  F  is  a  set  of  formulas,  dehne  V / Ki  =  {0  :  Kicf  E  V}  and  F/R  = 
{0  :  R0  G  F}.  Let  M™  =  (W,  tt,  Ai, . . . ,  A„,  . . . ,  K),  where 

•  W  =  {wv  :  V  is  a  maximal  AX^^-consistent  set  of  formulas} 

•  7i{wv){p)  =  true  if  and  only  if  p  G  V 

•  Xi  =  {{wv,wu):V/KiCU} 

•  Vi{wv)  =  (hL(^v.,i),Pl(«,v.,i)),  where  =  {wu  :  F/R  C  U},  Pl(^^,i)(0)  =  0,  and 

Pl(^^,i)(A)  =  1  for  A  7^  0. 

Using  standard  arguments,  it  is  easy  to  show  that  the  Aj’s  are  equivalence  relations  (see 
[HM92]).  Using  a  standard  induction  argument,  we  can  verify  that  {M^^,wv)  |=  0  if  and 
only  if  0  G  U. 

This  construction  proves  completeness  for  AX^^.  To  prove  completeness  for  the  other  two 
variants  we  use  the  same  construction,  setting  W  to  correspond  to  the  maximal 
consistent  sets  (resp.  AX^^’*"°^®’^®^^-consistent  sets).  We  must  show  that  the  resulting 
canonical  models  satisfy  CONS  and  NORM,  respectively. 

Let  be  the  canonical  model  constructed  for  To  show  that 

satishes  CONS,  it  is  enough  to  show  that  V / Ki  C  V / Bi.  To  show  this,  assume  0  G  V / K^. 
Then  iLj0  G  V.  Since  KB2  G  AX™P°^®,  we  conclude  that  Bicf  G  V,  and  thus  0  G  V / By 

Let  be  the  canonical  model  constructed  for  The  argu¬ 
ment  above  shows  that  satishes  CONS.  To  show  that  it  satishes  NORM, 
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i.e.,  Pl(to,i)(W^(«;,i))  >-L,  it  is  enough  to  show  that  V / Bi  is  consistent,  for  then  there  must 
be  some  U  such  that  V / G  U.  Assume,  by  way  of  contradiction,  that  V / B^  is  incon¬ 
sistent.  Then  there  are  formulas  0i, . . .  ,0^  G  V / B^  such  that  h  “1(01  A  ...  A  0^)-  Since 
01, . . . ,  0n  G  V / Bi,  we  conclude  that  5*01, . . . ,  5i0m  ^  V-  Using  the  K45  axioms  for  Bi, 
standard  arguments  show  that  5001, . . . ,  0^)  G  V,  and  hence  that  Bi{false)  G  V,  which 
contradicts  the  consistency  of  V.  □ 

Lemma  10:  Let  M  he  a  propositional  Kripke  strueture  of  knowledge  and  plausibility  satis¬ 
fying  CONS  and  SDP.  Suppose  that  w,  i,  and  a  are  sueh  that  the  most  plausible  worlds  in 
Viiw)  are  exaetly  those  worlds  in  ICi{w)  that  satisfy  a,  i.e.,  MPifPiiw))  =  {w'  G  ICi{w)  : 
{M,w')  1=  a}.  Then  for  any  formula  0  G  that  includes  only  the  modalities  Ki  and  Bi, 
{M,w)  \=  (f)  if  and  only  if  {M,w)  \=  0*,  where  0*  is  the  result  of  recursively  replacing  each 
subformula  of  the  form  Bifj  in  0  by  Ki{a  ^  fj*). 


PROOF.  We  prove  by  induction  that  for  any  w'  G  lCi{w),  {M,w')  |=  0  if  and  only  if 
{M,w')  \=  0*.  The  only  interesting  case  is  if  0  has  the  from  Bi(j)'.  Suppose  that  {M,w')  |= 
Bi(f)' .  This  implies  that  {M,w')  \=  true  -^i  0',  i.e.,  for  all  w"  G  MP(P0t(;'))  we  have 
{M,w")  1=  0'.  Now  let  w"  G  fCi{w').  If  {M,w")  |=  -^a,  then  {M,w")  \=  a  ^  (00*-  U 
(M,  w")  1=  a  then,  by  dehnition,  w"  G  MP(Pj(t(;)),  and  since  we  assumed  SDP,  MP('P0t(;'))  = 
MP('Pj(t(;)).  Thus,  we  conclude  that  {M,w")  \=  0',  and  using  the  induction  hypothesis  we 
get  that  {M,w")  \=  (00*.  We  conclude  that  all  worlds  in  ICi{w')  satisfy  a  (00*)  and  thus 
{M,w')  1=  Ki{a  ^  (00*)-  Now  assume  that  {M,w')  |=  Ki{a  ^  (00*)-  Let  w"  be  any  world 
in  fCiiw').  Since  we  assumed  SDP,  we  have  that  MP(Pj(t(;'0)  =  MP(Pj(t(;))  is  the  set  of 
worlds  in  lCi{w)  that  satisfy  a.  We  conclude,  using  our  induction  hypothesis,  that  all  worlds 
in  MP(Pj(t(;'0)  satisfy  0'.  Hence,  (M,  w"^  |=  true  — 0'.  Since  this  is  true  for  all  w"  G  lCi{w') 
we  conclude  that  (M,  w')  \=  Bi(f)'.  □ 


A. 2  Proofs  for  Section  2.8 


Theorem  11:  AX  is  a  sound  and  complete  axiomatization  for  with  respect  to  AA. 


PROOF.  Again,  we  just  describe  the  completeness  proof.  This  proof  draws  on  the  usual 
completeness  proofs  for  S5  modal  logic,  and  the  completeness  proof  for  conditional  logic 
described  in  [Fri97,FH97b]. 

We  proceed  as  follows.  If  U  is  a  set  of  formulas,  define  V/ Ki  =  {0  :  77*0  G  U}  and  U/A*  = 
{0  :  Aj0  G  U}.  We  dehne  a  canonical  model  =  {W,  n,  /Ci, . . . ,  /C„,  Vi, ... ,  Vn)  as  follows: 

•  IF  =  {wv  :  V  is  a  maximal  AX-consistent  set  of  formulas} 

•  Ti{wv){p)  =  true  if  and  only  if  p  G  F 

.  K,,  =  {{wv,wu):V/K,(ZU] 
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•  Viiwv)  =  where 

■  =  {wu  :  V/N,  C  U}, 

■  ^(wv,i)  =  {W\(wv,i)  ■  4>  e  where  [(l>]iwy,i)  =  {wu  e  :  (p  eU},  and 

■  is  such  that  P1(^„^.,^)([0](^„^,,^))  <  Pl{«;v,i)(M(w,h)  if  -^i  'P  ^V. 

We  need  to  verify  that  M'^  is  indeed  a  structure  in  A4.  Using  standard  arguments  it  is  easy  to 
show  that  the  /C*  relations  are  equivalence  relations.  In  [Fri97,FH97b]  we  prove  that  Viiwy) 
is  a  well-dehned  qualitative  plausibility  space. 

Finally,  we  have  to  show  that  {M^^wy)  |=  0  if  and  only  if  0  G  U.  As  usual,  this  is  done  by 
induction  on  the  structure  of  0.  We  use  the  standard  argument  for  formulas  of  the  form  Kip 
and  arguments  from  [Fri97,FH97b]  for  formulas  of  the  from  0  — 0.  We  omit  the  details 
here.  □ 

Theorem  12-.  Let  A  he  a  subset  of  [RANK,  NORM,  REF,  UNIF,  CONS,  SDR}  and  let  A 
be  the  corresponding  subset  of  { 05,  06,  07,  08,  09,  Cl  0} .  Then  AX  U  A  is  a  sound  and 
complete  axiomatization  with  respect  to  the  structures  in  M.  satisfying  A. 


PROOF.  Yet  again,  we  focus  on  completeness.  We  obtain  completeness  in  each  case  by 
modifying  the  proof  of  Theorem  11.  We  construct  a  canonical  model  as  in  that  proof,  checking 
consistency  with  the  extended  axiom  system.  The  resulting  structure  is  in  AA  and  has  the 
property  that  (M,  wy)  |=  0  if  only  if  0  G  U.  We  just  need  to  show  that  this  structure 
also  satishes  the  corresponding  semantic  restrictions. 

First,  we  consider  CONS  and  axiom  C9.  Assume  that  C9  is  included  as  an  axiom.  It  is 
easy  to  see  that  this  implies  that  U/W  C  V / Ky  This  implies  that  C  JC^^wy)  in  our 

construction. 

Now  consider  the  relationship  between  SDP  and  CIO.  Assume  that  CIO  is  included  as  an 
axiom.  We  need  to  show  that  if  wu  G  ICi{wy),  then  Viiwu)  =  Viiwy).  It  is  enough  to  show 
that  0  -^i  0  G  U  if  and  only  if  0  -^i  fj  E  U,  since  these  statements  determine  Vi  in  our 
construction.  Assume  0  — 0  G  U.  Then,  according  to  CIO,  Ki{(j)  — 0)  G  V,  and  thus 
0  — 0  G  V / Ky  Recall  that  Wjj  G  ICi{wy)  only  iiV/Ki  C  U.  We  conclude  that  0  -^i  0  G  U. 
The  other  direction  follows  from  the  fact  that  /Cj  is  symmetric  in  our  construction,  and  thus 
Wy  G  }Ci{wu). 

The  desired  relationship  between  RANK,  NORM,  REF,  and  UNIF  and  the  axioms  C5, 
C6,  C7,  and  C8  is  proved  in  [Fri97,FH97b],  for  a  logic  that  does  not  mention  knowledge. 
Since  these  conditions  put  restrictions  on  Vi{w)  and  do  not  involve  knowledge,  the  proof  of 
[Fri97,FII97b]  goes  through  unchanged;  we  do  not  repeat  it  here.  □ 

Theorem  13:  Let  A  be  a  subset  of  {CONS,  NORM,  REF,  SDP,  UNIF,  RANK}.  The  formula 
0  is  satisfiable  in  a  Kripke  structure  satisfying  A  if  and  only  if  it  is  satisfiable  in  a  Kripke 
structure  with  at  most  worlds. 
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PROOF.  The  proof  of  this  theorem  relies  on  techniques  from  [FH96a].  We  sketch  only  the 
main  steps  here.  The  proof  is  based  on  a  standard  hltration  argument. 


Suppose  there  is  a  structure  M  and  a  world  w  m.  M  such  that  {M,w)  \=  (j).  Let  Suh'^^cj))  = 
Subi^cj))  U  {-10  :  0  G  S''w6(0)}.  We  say  that  V  C  Sub'^{(j))  is  an  atom  if  for  each  0  G  Sub{(()), 
either  0  G  F  or  -i0  G  V.  We  say  that  a  world  w  in  M  satishes  an  atom  V  if  for  all  0  G  F, 

we  have  (M,  w)  \=  0.  It  is  easy  to  see  that  each  world  satishes  exactly  one  atom.  Given 

a  world  w',  we  dehne  [tc]  to  be  the  equivalence  class  containing  all  worlds  that  satisfy  the 
same  atom  as  w.  For  each  equivalence  class  [tc],  we  arbitrarily  choose  a  representative  world 
WH  G  [w].  We  dehne  M'  =  (W',  tt', /Ci, . . . /C^,  . . . ,  where  W'  =  {[w]  :  w  E  W}, 

7r'(H)  =  7r(wH),  /C'  =  ^  JCi},  and  v{{[w])  =  •),  Pl([^]_i)),  where 

^([w],i)  =  {["^1  •  ^  and  PlQ^]^j)(A)  <  Pl([^]^j)(R)  if  Pl(^j^j^j)(74*  n  < 

where  A*  =  {w'^  :  3[tc']  G  A,w''  G  [tc']}.  Arguments  essentially 
identical  to  those  of  [FH96a]  show  that  (M',  [tc])  |=  0  if  and  only  if  {M,w)  \=  0  for  all 
0  G  Sub{(l))]  we  omit  details  here. 


We  now  have  to  describe  how  to  modify  this  argument  to  ensure  that  M'  satishes  A.  The 
modihcations  for  NORM,  REF,  UNIF  and  RANK  are  described  in  [FH96a].  Suppose  that  M 
satishes  CONS.  Let  [tc']  G  By  dehnition,  w'  G  But  since  M  satishes  CONS, 

we  have  that  w'  G  ICi{w[w])-  By  dehnition,  we  get  that  [tc']  G  /C0[tc]).  We  conclude  that  M' 
satishes  CONS.  Finally,  suppose  that  M  satishes  SDP.  We  force  M'  to  satisfy  SDP  as  follows. 
For  all  worlds  w,  we  choose  a  representative  world  tCACi([to])  ^  such  that  if  (tc,  w')  G  Ki, 

then  wiCi{[w])  =  '?UACi([to'])-  We  then  modify  the  construction  so  that,  for  each  world  v  G  ICi{w), 
we  have  V[{\v])  =  V[{w)cp[w]))-  R  is  easy  to  see  that  for  all  0  — y  G  Sub^cf)),  we  have  that 
{M,w)  1=  0  — X  if  and  only  if  {M,WJc^([w]))  \=  0  -^i  X-  Thus,  it  is  easy  to  show  that 
after  this  modihcation  we  still  have  that  (M',  [tc])  |=  0  if  and  only  if  {M,w)  \=  0  for  all 
0  G  Sub{(l)).  □ 


Theorem  15:  Let  A  be  a  subset  of  {CONS,  NORM,  REF,  SDP,  UNIF,  RANK}  eontaining 
CONS  and  either  SDP  or  UNIF.  If  0  talks  about  the  knowledge  and  plausibility  of  only  one 
agent,  then  0  is  satisfiable  in  a  Kripke  structure  satisfying  A  if  and  only  if  it  is  satisfiable 
in  a  preferential  Kripke  structure  satisfying  A  with  at  most  |Sub(0)|^  worlds. 


PROOF.  Assume  M  =  (IT,  tt, /Ci,  Pi)  is  a  structure  satisfying  0.  Since  CONS  is  in  A,  we 
must  have  that  lT(^^i)  C  ]Ci{w)).  Without  loss  of  generality,  we  can  assume  that  /Ci  consists 
of  one  equivalence  class,  that  is,  that  /Ci  =  IT  x  IT.  Since  CONS  and  SDP  imply  UNIF,  and 
since  A  contains  CONS  and  either  SDP  or  UNIF,  we  conclude  that  M  satisfies  UNIF.  Using 
techniques  from  [FH96a]  we  can  assume,  without  loss  of  generality,  that  for  each  world  w, 
the  plausibility  space  Vi{w)  is  preferential  (i.e.,  induced  by  some  preference  ordering)  and 
that  lT(^„^i)  has  at  most  \Sub{(j))\^  worlds. 

Choose  wq  E  W  such  that  (M,  wq)  \=  0.  For  each  formula  -iiFi0  G  Sub^cf)  such  that 
{M,wq)  \=  “>iLi0,  we  select  a  world  such  that  {M,w,f,)  \=  ->0.  Let  T  be  {tco}  U 
{w^  :  ^Kifj  E  Sub^cf)}.  Note  that  the  cardinality  of  T  is  at  most  |S''U00)|.  Define  M'  = 
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iW' ,Ti' ,lC'i,V'i)  by  taking  W  to  be  the  union  of  for  each  w  E  T,  taking  n'  to  be  n 

restricted  to  W ,  and  taking  V[{w)  =  Viiw).  Clearly  |hh'|  is  at  most  \Sub{(j))f.  A  straightfor¬ 
ward  argument  for  all  subformulas  of  0  and  all  worlds  w'  G  W',  we  have  (M,  w')  |=  0  if  and 
only  if  {M',w')  \=  iIj.  It  follows  that  {M',wo)  |=  0,  so  0  is  satisfiable  in  a  small  preferential 
structure.  □ 

Theorem  16:  Let  A  be  a  subset  of  {CONS,  NORM,  REF,  SDR,  UNIF,  RANK}.  If  CONS  E 
A,  but  it  is  not  the  case  that  UNIF  or  SDR  is  in  A,  then  the  validity  problem  with  respect 
to  structures  satisfying  A  is  complete  for  exponential  time.  Otherwise,  the  validity  problem 
is  complete  for  polynomial  space. 


PROOF.  The  proof  combines  ideas  from  [FH94a,FH96a,HA192].  We  briefly  sketch  the  main 
ideas  here,  referring  the  reader  to  the  other  papers  for  details. 

The  polynomial  space  lower  bound  follows  from  the  polynomial  space  lower  bound  for  logics 
of  knowledge  alone  [HM92].  For  the  exponential  lower  bound  we  use  exactly  the  lower  bound 
described  Fagin  and  Halpern  [FH94a]  for  the  combination  of  knowledge  and  probability 
(which  is  in  turn  based  on  the  lower  bound  for  PDF  [FL79]).  This  lower  bound  construction 
uses  only  formulas  involving  Ki  and  probabilistic  statements  of  the  form  Wi{(j))  =  1  (i.e.,  the 
probability  of  0  is  1).  Since  Aj0  has  exactly  the  same  properties  as  tCj(0)  =  1,  the  same 
construction  applies  to  our  logic. 

In  the  cases  where  we  claim  a  polynomial  space  upper  bound,  this  is  shown  by  proving 
that  if  a  formula  0  is  satishable  at  all,  it  is  satisfiable  in  a  structure  that  looks  like  a  tree, 
with  polynomial  branching  and  depth  no  greater  than  the  depth  of  nesting  of  /C*  and  — 
operators  in  0.  The  result  now  follows  along  similar  lines  to  corresponding  results  for  logics 
of  knowledge. 

Finally,  the  exponential  time  upper  bound  follows  by  showing  that  if  a  formulas  is  satishable 
at  all,  it  is  satishable  in  an  exponential  size  structure  that  can  be  constructed  in  deterministic 
exponential  time;  the  technique  is  similar  to  that  used  to  show  that  logics  of  knowledge  with 
common  knowledge  are  decidable  in  deterministic  exponential  time  [HM92]  or  that  PDF  is 
decidable  in  deterministic  exponential  time  [Pra79].  □ 

Theorem  17:  Let  A  be  a  subset  of  {CONS,  NORM,  REF,  SDR,  UNIF,  RANK}  containing 
CONS  and  either  UNIF  or  SDR.  For  the  case  of  one  agent,  the  validity  problem  in  structures 
satisfying  A  is  co-NP-complete. 


PROOF.  We  show  that  the  satishability  problem  is  NP-complete.  It  follows  that  the  validity 
problem  is  co-NP-complete.  The  lower  bound  is  immediate,  since  clearly  the  logic  is  at  least 
as  hard  as  propositional  logic.  For  the  upper  bound,  by  Theorem  15,  0  is  satishable  in  a 
structure  satisfying  A  if  and  only  if  0  is  satishable  in  a  structure  M  of  size  polynomial  in 
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|0|.  We  simply  guess  a  structure  M  and  check  that  0  is  satishable.  It  is  easy  to  show  that 
model  checking  can  be  done  in  polynomial  time  (see  [HM92,FH96a]).  □ 


A. 3  Proofs  for  Section  3.3 


Theorem  20:  The  axiom  system  AX^  is  a  sound  and  complete  axiomatization  of 
with  respect  to  C. 


PROOF.  As  usual,  we  focus  on  completeness.  Again,  we  construct  a  canonical  interpreted 
system  X  such  that  if  0  G  is  consistent,  then  0  is  satished  in  X.  The  outline  of  the 

proof  is  similar  to  that  of  Theorem  11. 

We  proceed  as  follows.  Let  F  be  a  maximal  AXWconsistent  set  of  formulas  in  We 

dehne  V/Q  =  {0  :  00  ^  We  claim  that  V/Q)  is  also  a  maximal  AXWconsistent  set. 
To  show  that  V/(f)  is  maximal,  assume  that  0  ^  h^/O-  Then  O0  ^  X.  From  axiom  T2, 
we  have  that  O“'0  ^  X,  and  thus,  ->0  G  F/O-  This  shows  that  F/Q  is  maximal.  To  show 
that  V/Q  is  AXWconsistent,  assume  that  there  are  formulas  0i,...0n  G  V/Q  such  that 
“'(01  A  ...  A  0n).  From  Kl,  T1  and  RTl  we  get  that  false  G  V/Q.  Thus,  Qfalse  G  V. 
Using  T2  we  get  that  -^Qtrue  G  V.  Using  RTl,  however,  we  get  that  Qtrue  G  V,  which 
contradicts  the  assumption  that  V  is  consistent.  Thus,  V/Q  is  AX^-consistent.  Finally,  we 
dehne  U/0™  to  the  result  of  m  applications  of  /Q.  Repeated  applications  of  the  above 
argument  show  that  V/Q^  is  a  maximal  AX^-consistent  set  for  all  m  >  0. 

We  construct  a  canonical  interpreted  system  as  follows.  Let  X  =  (7^,  tt,  Xi, . . . ,  Xn),  where 

•  X  =  {r^  :  V  C  jg  maximal  AX^consistent  set}  such  that 

■  r'fim)  =  V/Q^,  and 

■  rY{m)  =  {V/QQ/X, 

•  7r(r^, m){p)  =  true  if  and  only  if  p  G  (m),  and 

•  Vi{r^,m)  =  iyVi^,v^rn,{)X\rV,m,{)),  where 

■  =  {(r^,n)  :  {V/QQ/N,  C  X/0"  },  and 

•  P^rV, m,i)  is  such  that  Plpv,m,i)([0](rV,m,i))  <  Pl{rV,m,i) ( [0] T  and  Only  if  (0V0) 

0  G  u/o™,  where  [4>](rV^m,i)  =  {{r^ ,  k)  G  W(rV^m,i)  ■  0  e  U/Q^}. 

Using  the  arguments  in  the  completeness  proof  for  conditional  logic  of  [Fri97,FH97b],  we 
can  show  that  Xj(r,  m)  is  well-dehned  for  all  i.  Finally,  we  have  to  show  that  (X,  r^,  m)  |=  0 
if  and  only  if  0  G  (m) .  As  usual,  this  is  done  by  induction  on  the  structure  of  0.  This 
is  identical  to  the  proof  in  of  Theorem  11  except  for  the  Q  modality,  which  is  handled  by 
standard  arguments.  We  omit  the  details  here.  □ 

Theorem  21-.  Let  A  he  a  subset  of  [RANK,  NORM,  REF,  UNIF,  CONS,  SDR}  and  let  A 
be  the  corresponding  subset  of  { 05,  06,  Cl,  08,  09,  Cl  0} .  Then  AlQ  U  A  is  a  sound  and 
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complete  axiomatization  with  respect  to  systems  in  C  satisfying  A. 


PROOF.  Again,  we  focus  on  completeness.  We  obtain  completeness  in  each  case  by  modi¬ 
fying  the  proof  of  Theorem  20.  We  construct  a  canonical  system  as  in  that  proof,  checking 
consistency  with  the  extended  axiom  system.  The  resulting  system  has  the  property  that 
{I,r^,m)  1=  0  if  and  only  if  0  G  V/Q^.  We  just  need  to  show  that  this  system  satishes 
the  corresponding  semantic  restrictions.  The  desired  relationship  between  these  semantic 
properties  and  axioms  is  proved  in  [Fri97,FH97b]  and  the  proof  of  Theorem  12.  □ 


A. 4  Proofs  for  Section  4-1 


Proposition  25:  Let  X  he  a  synchronous  system  satisfying  perfect  recall  and  PRIOR.  If  (p 
characterizes  agent  i’s  knowledge  at  {r,m  -|-  1)  with  respect  to  his  knowledge  at  {r,m),  then 
(J,  r,m  +  1)  \=  ^jJ  f  if  and  only  if  (J,  r,  m)  |=  0(0  A  0)  OC- 


PROOF.  Expanding  the  dehmtion  we  get  that  VT.  ( (0  A  ”0  j  J  p  G  :  (r 

{r,m),  {r',m  +  l)  \=  0A0}.  Similarly,  we  get  that  77([0]p,m+i))  =  {r'  G  fF(r,i)  :  (r',m-|-l) 

(r, m-|- 1),  {r',m  +  l)  \=  ip}.  However,  since  0  characterizes  agent  i’s  knowledge  at  time  m-|- 1 
with  respect  to  his  knowledge  at  time  m,  we  get  that  (r',  m  -|-  1)  (r,  m  -|-  1)  if  and  only  if 

(r',m)  (r,m)  and  (r,m-f  1)  ^  0-  We  conclude  that  77([O(0  A  0)]p,m))  =  77([0]p,m+i))- 

The  lemma  now  follows  directly  from  Proposition  22.  □ 

Lemma  28:  Let  X  he  a  synchronous  static  system  satisfying  PRIOR,  RANK,  SDP,  and 
perfect  recall  that  has  finite  branching.  Then  (J,  r,  m)  \=  BiCp  =  BiQBiCp  for  all  propositional 
formulas  0. 


PROOF.  For  all  points  (r,  m)  in  X,  note  that  W(^r,m,i)  =  where  is  the  set  of  points 

{r',m)  {r,m)  such  that  the  agent’s  new  knowledge  at  time  m  -|-  1  is  0.  If  X  has  hnite 

branching,  this  is  a  hnite  partition  of  Additionally,  note  that  if  Pl(r,m,i)  is  a  ranking, 

and  Cl, . . . ,  Cfc  is  a  hnite  partition  of  C,  then  since  P\r,m,i){C)  =  maxi<j<fc  P\r,m,i){C j) ,  there 
must  be  some  j  such  that  Plp,m,i)(Cj')  =  Pl(r,m,i)(C')-  In  particular,  for  all  C  C  either 

Pl(r.,n^,*)(C')  =  T  or  P\r,mdWir,m,i)  -  C)  =  T .’ 

For  the  part,  suppose  that  (X,r,m)  \=  BiCp.  If  Pl(r,m,i)(hFp,m,i))  =  X,  then  {X,r,m)  |= 
BiQBiCj)  vacuously.  If  Pl(r,m,i)(hF(^,m,i))  0  X,  then  Pl(r,m,i)([0l(r,m,i))  >  Pl(r,m,i)([-'0l(r,m,i))- 
Assume  that  ip  is  such  that  Plp,m,i)(A.0)  =  T.  It  is  easy  to  verify  that  since  Pl(r-,m,i)  is  a  rank¬ 
ing,  we  get  that  P^rndd  A  [0](r,m,p)  >  Pl(r,m,i)(A^  H  [-'0]  )  •  Let  P  be  a  run  such  that 

(r',m)  G  A^p.  By  SDP,  we  get  that  Plp,m,i)  =  Pl(r',m,i),  and  thus  n  {(pd ,m,i))  > 

Pl(r',m,i)(A^  n  [“'0](r',m,i))-  By  dehuitiou  of  Apj,  we  have  that  {r" ,m  +  1)  (r',m  -|-  1)  if 

and  only  if  {r" ,m)  G  A^.  Since  X  satishes  PRIOR,  P\{r',m,+i,i)  is  the  result  of  conditioning 
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Pl(r,m,i)  on  A^.  Moreover,  since  propositions  are  static,  we  get  that  Plp',m+i,j)([0](r',m+i  ,h)  > 
Pl(r',m+l,i)([-'0l(r',m+l,i))-  ThuS,  {I,  A, Til)  ^  We  COnclude  that  C  [OBi(t)\r,m.,i), 

and  thus  Pl(r,m,i)( [0-^*0] (r,m,i))  =  T.  Moreover,  since  A^  C  [0-^*0] for  all  A^  such  that 
Pl(r,m,i)  (^p)  T,  we  get  that  Pl^j.  ^  ^^^^{Pl(r,m,i)  •  Pl(r,m,i)  (^p)  ^ 

T}  <  T.  We  conclude  that  Plp,m,i)([O5i0l(r,m,i))  >  Pl(r,m,i)([-'O5i0l(r,m,i)),  and  thus, 
(J,  r,  m)  1=  BiQBicj). 

For  the  “<^=”  part,  suppose  that  (X,  r,  m)  \=  BiQBi(f>.  If  Pl(r,m,p(hF(r^m,i))  =  X,  then  (X,  r,  m)  |= 
i?j0  vacuously.  If  Pl(r,m,i)(hF(r,m,i))  7^  X)  then  Pl^j.  p  (|Q.Bj0j ^ 
Pl(r,m,i) ( [~'O-®i0l ) •  Thus,  siuce  Pl(r',m,i)  Is  a  ranking,  Pip p (|Q5j0j p )  T.  Let 

(r',  m)  be  some  point  in  A^  for  some  0.  By  SDP,  we  have  that  (X,  r',  m)  \=  C)B(I)  if  and  only 
if  {X,r",m)  1=  O-B0  for  all  points  {r\m)  e  A^.  Thus,  [O-Bi0](r,m,i)  =  U  ...  U  A^^^ 
for  some  0i,...,0fc.  Since  Pip,™,*) ( [05*01  (r,m,i))  >  Pl(r,m,*)([“'O5i0]p,™,*)),  we  get  that 
Pl(r,m,*)(^p)  =  T  only  if  0  =  -ipj  for  some  1  <  j  <  k.  Moreover,  since  A^^, . . . ,  is  a  hnite 
partition  of  [05*0]  (r,m,*),  there  must  be  at  least  one  1  <  j  <k  such  that  Plp,*,*,*)(74p.)  =  T. 
Let  'ipj  be  such  that  Plp,,**,*)(ylp^.)  =  T.  Suppose  that  {r',m)  G  A^..  Then  we  have  that 
Pl(r',m+I,*)([0l(r',m+1,*))  >  Plp',m+i,*) ( [“'01  p',m+i,*) ) .  Siuce  X  is  syuchronous,  static,  and  sat- 
ishes  perfect  recall,  PRIOR,  and  SDP,  we  get  that  Pip,***,*)  (Rp^  fl  [0]p,m,*))  >  Pl(r,m,*)(^Pj  O 
l“’0l(r,m,*))-  Since  Plp,***,*)  is  a  ranking,  we  get  that  Pip,***,*)  (Rp .  O  [0lp,m,*))  =  T,  and  thus, 
Pl(r,m,i)  ( [0] (r,m,*) )  X.  Finally,  if  Plp,***,*) (Rp)  <  T,  then  Pip,***,*) (Rp n |“'0] p,**j,*) )  <  T.  Thus, 
since  Pl(r,m,i)([~'0](r,m,*))  IH&Xp  Pip, ***,*)  (Rp  O  [~'0]  ) )  We  get  that  Pl(r-, m, *)(  [~'0]  ^ 

T.  We  conclude  that  (X,  r,  m)  |=  R*0-  ^ 


A .  5  Proofs  for  S ection  4  ■  2 


Theorem  32:  Let  A  be  a  subset  of  {QUAL,  NORM,  REF,  RANK]  and  let  X  be  a  coherent 
synchronous  system  satisfying  perfect  recall,  CONS,  and  A.  Then  there  is  a  synchronous 
system  X'  satisfying  perfect  recall,  PRIOR,  and  A,  and  a  mapping  f  ■.  IZ  ^  IZ'  such  that  for 
all  temporally  linear  formulas  0  G  ,  we  have  (X,  r,m)  |=  0  */  ond  only  if  (X',  f{r),m)  |= 

0. 


PROOF.  To  construct  X',  we  use  a  general  technique  for  taking  a  “sum”  of  a  sequence 
of  plausibility  spaces.  Let  A  be  an  ordinal  and  let  {5*  :  0  <  i  <  A}  be  a  sequence  of 
plausibility  spaces,  where  S'*  =  (hF*,  PI*)  and  the  IF*’s  are  pairwise  disjoint.  Dehne  ®iSi  as 
(U*IF*,PW*),  where  Pl®5*(Al)  >  Pl®5*(5)  if  either  Pl*(Al  0  W*)  =  P1*(R  0  W*)  =  T  for 
all  i,  or  there  exists  some  i  such  that  P1*(R  ft  W*)  >  Pl*(5  fl  hF*),  P1*(R  fl  hF*)  >T,  and 
Plj(R  n  Wj)  =  Plj(5  n  Wj)  =  T  for  all  j  <  i.  We  can  think  of  ©*5*  as  a  lexicographic 
combination  of  the  S'*’s. 

Lemma  35  (a)  ©*5*  is  a  plausibility  space, 

(b)  if  Si  is  qualitative  for  all  i,  then  ©*5*  is  qualitative, 

(c)  if  Si  is  ranked  for  all  i,  then  ©*5*  is  ranked. 
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(d)  ((BiSi)\c  is  isomorphic  to  ©i(S'j|c)  under  the  identity  mapping. 

(e)  (©i*S'j)|vyj  is  isomorphic  to  Sj  under  the  identity  mapping. 

(f)  If  Wi, . . . ,  Wk  =  0,  then  (BiSi  is  isomorphic  to  (Bi>k+iSi. 


PROOF.  We  have  to  show  that  <  is  reflexive,  transitive,  and  satisfles  Al.  It  is  easy  to  see 
that,  by  deflnition,  <  is  reflexive.  Next,  we  consider  transitivity.  Snppose  that  Pl0S'.(A)  > 
P1®5.(5)  and  PW.(5)  >  PW,(C').  If  Ph(RnWi)  =  for  all  then  clearly  VfCnWf)  =  U 
for  all  i  (since  P1®5,(R)  >  Pl0s,(C)),  so  P1®5,(A)  >  P1®5,(C).  So  snppose  that  Pl(RnlPi)  > 
©i  for  some  i.  Let  i  and  j  be  the  smallest  indexes  snch  that  Pb(A  ft  W)  >  ©j  and  Plj(R  H 
Wj)  >  ©j.  It  is  easy  to  see  that  i  <  j,  and  that  Plfc(C  fl  Wk)  =  ©fc  for  all  A;  <  j.  If  i  <  j,  we 
conclnde  that  Ph(An  Wi)  >  Ph(C  fl  Wi)  =  ©i,  and  thus  PI®5.(A)  >  PI®5.(C).  On  the  other 
hand,  \ii  =  j,  then  by  deflnition  Ph(A  fl  Wi)  >  Ph(i?  fl  Wi),  and  Ph(i?  fl  Wi)  >  Ph(0  fl  Wi). 
Since  <  is  transitive  in  Si,  we  get  that  Pb(A  fl  Wf)  >  Pb(0  fl  Wi).  Thus,  we  conclude 
that  Pl05.(A)  >  ©105.(0),  as  desired.  Finally,  we  consider  Al.  Suppose  that  A  B.  Then 
A  n  ITi  C  R  n  IFj  for  all  i.  Since  each  Si  satisfles  Al,  we  have  that  Pb(A  fl  Wi)  <  Pb(0  fl  Wi) 
for  all  i.  It  easily  follows  that  Pl05.(A)  <  Pl05.(R). 

Suppose  that  Si  is  qualitative  for  all  i.  We  have  to  show  that  ®iSi  is  also  qualitative.  We 
start  by  considering  A2.  Suppose  that  A,  B,  and  O  are  pairwise  disjoint  sets  such  that 
Pl05.(A  U  R)  >  Pl05.(O)  and  Pl05.(A  U  O)  >  Pl05.(R).  Let  i  and  j  be  the  minimal  indexes 
such  that  Pb((A  U  R)  fl  Wi)  >  ©j  and  Plj((A  U  O)  O  Wj)  >  ©j.  We  claim  that  i  =  j. 
Assume,  by  way  of  contradiction,  that  i  <  j.  Then,  Pb((A  U  O)  fl  Wi)  =  ©j  and  hence 
Ph(A  n  Wi)  =  ©j.  Moreover,  since  Pl05.(A  U  O)  >  Pl05.(R),  we  get  that  Ph(R  fl  Wi)  =  ©*. 
Using  A3  in  Si,  we  conclude  that  Ph((A  U  R)  fl  Wi)  =  ©*,  which  contradicts  our  assumption 
that  Pb((A  U  R)  n  Wi)  >  ©j.  Symmetric  arguments  show  that  we  also  cannot  have  j  <  i. 
Thus,  i  =  j.  By  deflnition  Pb((AUR)nW)  >  Pb(C'nW)  and  Pb((AuC')nW)  >  Pb(RnW). 
Using  A2  we  conclude  that  Pb(A  fl  Wf)  >  Pb((R  U  U)  fl  Wi).  It  is  also  easy  to  verify,  using 
A3,  that  Plj((R  U  U)  n  Wj)  =  ©^  for  all  j  <  i.  Thus,  we  get  that  Pl05.(A)  >  Pl05.(R  U  C), 
as  desired.  Next,  consider  A3.  The  construction  of  ®Si  is  such  that  Pl05.(A)  =©  if  and  only 
if  Pli(A  n  Wi)  =©  for  all  i.  It  is  easy  to  see  that  A3  follows  from  A3  in  each  Si. 

Finally,  part  (c)  follows  immediately  from  the  deflnition,  part  (d)  follows  immediately  from 
COND,  part  (e)  is  a  special  case  of  part  (d),  and  part  (f)  follows  immediately  from  the 
deflnition.  □ 


Returning  to  the  proof  of  Theorem  32,  first  suppose  that  REF  is  not  in  A.  Let  X  = 
iJZ,  Ti,Vi, ...  ,Vn)  be  a  coherent  synchronous  system  satisfying  perfect  recall  and  CONS. 
Roughly  speaking,  the  proof  goes  as  follows.  We  construct  a  system  X'  which  consists  of 
countably  many  copies  of  TZ.  The  runs  in  TV^,  the  mth  copy  of  IZ,  are  used  to  simulate  the 
agent’s  plausibility  assessment  at  time  m.  More  precisely,  for  all  times  m,  we  define  a  prior 
on  IZ'^  that  corresponds  to  the  agent’s  plausibility  measure  at  time  m  in  X.  These  priors 
are  then  combined  using  ©  to  construct  the  agent’s  prior  in  X'.  Since  ©  orders  the  priors 
lexicographically,  if  m  <  m' ,  the  priors  on  7?.™  dominate  those  on  IZ'^  .  The  construction 
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guarantees  that  at  time  m,  the  agent  considers  possible  only  runs  in  U  U _ Since 

the  prior  on  dominates  the  rest,  the  agent’s  plausibility  measure  at  time  m  is  similar 
to  that  at  time  m  in  X.  This  similarity  is  what  guarantees  that  conditional  formulas  are 
evaluated  in  the  same  way  in  X  and  X'.  This  “peeling  away”  of  copies  of  TZ  ensures  that  all 
temporally  linear  formulas  holding  in  runs  in  X  are  also  satished  in  the  corresponding  rnns 
inX'. 

The  formal  constrnction  proceeds  as  follows.  Let  i?  C  7^  and  I  G  IN*  (recall  that  IN*  = 
IN  U  {cxd}).  Dehne  7?*  =  {r*  :  r  G  R},  where,  for  each  i  E  {e,  1 . . . ,  n},  we  have 

{{ri(m),m)  if  /  >  m 
{ri{l),m)  if/  <  m. 

Let  X'  =  {7Z' ,n' ,V'i, . . .  where  TZ'  =  is  dehned  so  that  if  m  <  /  then 

7i'{r\m)  =  n{r,m)  and  if  m  >  /  then  7i{r\m)  =  7r(r, /),  and  7^'  is  dehned  by  the  priors 
described  below. 

To  dehne  a  prior  on  TZ',  we  hrst  dehne  a  plausibility  space  7^™j)  on  TZ'"'  for  each  m  G  IV,  rnn 
r  E  TZ,  and  agent  i.  We  want  the  time  m  projection  of  to  be  isomorphic  to  Xj(r,  m). 
To  achieve  this,  we  dehne  =  (X™  PI™  j)),  where  =  X(lXp,m,i))™  and  PI™*)  is 

dehned  so  that  for  A  C  we  have  PI™ j)((X(yl))”^)  =  ■  For  I  E  IN*,  we 

dehne  the  prior  of  agent  i  at  rnn  A  to  be  the  combination  of  these  priors  for  all  time  points: 
=  ©mX(™i)- 

It  is  easy  to  see  that  X'  is  synchronous.  It  is  also  easy  to  check  that  X'  satishes  perfect  recall: 
From  the  dehnition,  we  have  that 

,  {{r"'' ,m)  :  {r',  m)  E  /Ci(r,  m),l'  >  m}  if  /  >  m 

/C.(r,m)  =  <^ 

y  {{r'^m)  :  (r',/)  ^  if  /  <  m. 

Moreover,  since  X  satishes  perfect  recall,  we  have  that  X(/C*(r,  m  +  1))  C  X(/Cj(r,  m)).  We 
conclude  that  X'(/C'(r^,m  +  1))  C  X'(/C'(r^, m)),  which  is  just  what  we  need  for  perfect 
recall. 

Let  0  G  (so  that  0  does  not  inclnde  any  temporal  modalities)  and  I  >  m.  We  show 
that  {X',r\m)  |=  0  if  and  only  if  (X,r,m)  |=  0.  As  usnal  we  prove  this  by  indnction  on  the 
strnctnre  of  0.  The  only  interesting  cases  are  these  that  directly  involve  modalities. 

We  start  with  the  TV*  modality.  Snppose  that  (X,  r,  m)  \=  Kicj).  Then  for  all  points  (s,  m)  E 
ICiir,  m),  we  have  (X,  s,  m)  \=  0.  Let  (s^,  m)  E  /C'(r0  m).  From  the  dehnition  of  X'  we  get  that 
(s,  m)  G  Ki{r,m)  and  k  >  m.  Using  the  indnction  hypothesis,  we  get  that  {X',s^,m)  |=  0. 
We  conclnde  that  (X',  r\  m)  |=  Kicj).  Now  snppose  that  (X,  r,  m)  ^  Kicj).  Then  there  is  a  point 
(s,  m)  E  ICiir,  m)  snch  that  (X,  s,  m)  \=  ->0.  Using  the  indnction  hypothesis  we  conclnde  that 
(X,  s™,m)  1=  -10.  Since  (s™,m)  G  /C'(r^,m),  we  conclnde  that  (X',r^,m)  ^  17*0. 
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We  now  turn  to  the  -^i  modality.  The  dehnition  of  PRIOR  implies  that  V[{r\m)  is  the 
projection  of  V'^^i  conditioned  on  7^'(/C'(r^,  m)).  Now  j)  =  ©mPlp,*)-  Parts  (d)  and 
(f)  of  Lemma  35  imply  that  V'^^i  i)\n' (K’\ri ,m))  is  isomorphic  to  ®k>m{V^r,i))W'{.^{rKm)))■  Con¬ 
sider  the  first  term  in  the  “sum”,  Pp ^)|7^' (a:' (r^m))-  Since  X  satishes  CONS,  we  have  that 
hP(r,m,i)  X  ICi{r,m).  Thus,  conditioning  on  lZ\K[{r\m))  does  not  remove  any  runs  from 

It  follows  that  Xpli)  k'(^'(r5m))  =  which  is  isomorphic  to  Vi{r,  m) 
under  the  mapping  i— >  {r',m).  Finally,  since  is  the  hrst  plausibility  space  in  the 

“sum” ,  it  determines  the  ordering  of  all  pairs  of  sets,  unless  both  of  them  are  assigned  plau¬ 
sibility  T  by  Pl^  j).  Putting  all  this  together,  we  conclude  that  if  A',B'  C  and 

A,BC  W(^r,m,i)  such  that  {TZ{A))'^  =  TV {A')  fl  7^™  and  {TZ{B))'^  =  1Z'{B')  fl  7^™,  and  if 
P\(r,m,i)iA)  >  1,  then  Pl(p  >  Pl(p  if  and  only  if  P\^r,m,i)iA)  >  P\(r,m,i)iB). 

Assume  that  {I,r,m)  ^  Thus,  either  =  T  or  Pl(,,^^^i)([0  A 

^]{r,m,i))  >  Pl(r,m,i)([0A-.V’](r,m,i))-  If  Plp,m,i)  ( [0l  )  =  T,  then  from  the  cohereuce  of  Jit 

follows  that  if  A  C  W(^r,i',i)  and  7?.(A)  C  7^([0](r,m,i)),  then  Plp^;/^j)(A)  =  T.  This  implies  that 
0  7^(IF(r,r,i))*')  =  T  for  all  I'  >  171.  Siuce  IC[{r\m)  contains  only  points 
from  TZ’-'  for  I'  >  m,  we  get  that  Pl(P,m,i)(M(r5m,i))  =  T-  Thus,  we  conclude  that  (X',  A,  m)  \= 
4>  ip  in  this  case.  Now  suppose  that  Plp,m,i)([0  A  ipj(r,m,i))  >  Pl(r,m,i)([0  A  -^ipj(r,m,i)) ■  If 
we  could  show  that  (7?.([0](r,m,i)))™  =  C  and  similarly  for  ip,  then  we 

could  apply  the  argument  of  the  previous  paragraph  to  show  that  Plpi,m,i)([0  A  ip](r‘,m,i))  > 
PI(rtm,i)([0A-''^]pi,m,i))-  This,  in  turn,  would  allow  us  to  conclude  that  {I',r\m)  \=  p  — ip. 
The  fact  that  (7^('[0'](r,m,i)))™  =  7^^([0](A,m,i))  C  TZ"^  follows  from  the  following  chain  of 
equivalences: 

S-  e  {nm^r,m,^))r 

iff  (s,m)  e  [0]{r,m,i) 

iff  (s,  m)  G  W(r,m,i)  and  (X,  s,m)  \=  p 

iff  e  (7^(IF(r,m,i)))”^  =  and  (by  the  induction  hypothesis)  (X',  s™,  m)  \=  p 

iff  {s^,m)  G  IF(ri,m,i)  and  (X',  s™,m)  |=  p 

iff  {s^,m)  E  lp]^r‘,m,i) 

iff  s-G7^([0](p,^,))^7^-. 

Thus,  in  either  case,  we  conclude  that  {TPr\m)  \=  p  — p,  as  desired. 

For  the  converse,  suppose  that  {I,r,m)  ^  p  — p.  Then  Pl(r,m,i)([0](r,m,i))  >  T  and 
Pl(r,m,i)([0  A  p](r,m,i))  Pl(r,m,i)([0  A  -^p\r,m,i))-  By  the  Same  arguments  as  above,  we  get 

that  Pl(p^^^i)([0  A  >  T  and  ^  Pl(A,m,p([0  A 

Thus,  {I',rPm)  ^  p  — p,  as  desired. 

Finally,  for  r  E  7Z,  dehne  /(r)  =  r°°.  We  have  proved  that  if  0  G  then  {I,r,m)  \=  p 

if  and  only  if  {ipf{r),m)  \=  p.  Since  this  holds  for  all  m,  a  straightforward  argument 
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by  induction  on  structure  shows  that  this  holds,  not  just  for  formulas  in  ,  but  for  all 
temporally  linear  formulas. 

We  now  have  to  ensure  that  X'  satishes  A.  Suppose  that  X  satishes  QUAL.  Thus,  Vi{r,m) 
is  qualitative  for  all  agents  i,  runs  r  &  R,  and  times  m.  Using  part  (b)  of  Lemma  35,  we 
conclude  that  the  prior  V[ri)  qualitative  for  all  agents  i  and  runs  r  E  R.  This  implies, 
using  Proposition  29,  that  X'  satishes  QUAL.  Similarly,  if  X  satishes  RANK,  using  part  (c) 
of  Lemma  35  and  Proposition  29,  we  get  that  X'  satishes  RANK. 

Suppose  that  X  satishes  NORM.  Then  >  T  for  all  agents  i,  runs  r  ElZ,  and 

times  m.  This  implies  that  ->{true  — false)  is  valid  in  X.  Suppose  that  I  >  m.  Then  since 
-^{true  — false)  E  we  conclude  from  the  proof  above  that  {X',r\m)  \=  -^{true  — 

false).  Thus,  Pl^^i  p)  >  T.  Suppose  that  /  <  m.  By  dehnition,  we  have  that 

R' {JC[{r\m))  =  (7l{)Ci{r,l))y.  Using  part  (e)  of  Lemma  35,  we  get  that  X’(Vp)|-R,'(jc'(r*,m))  is 
isomorphic  to  However,  the  latter  plausibility  space  is  isomorphic  to  Vi{r,l).  Thus,  it 

satishes  T  >  T.  We  conclude  that  X'  satishes  NORM,  as  desired. 

Up  to  now  we  have  assumed  that  REF  is  not  in  A.  If  REF  is  in  A,  then  REF  does  not  hold  for 
A,  although  it  does  hold  at  many  points.  To  understand  the  issue,  suppose  that  REF  holds 
in  X.  Since  X'  satishes  PRIOR,  to  show  that  REF  holds  in  X',  according  to  Proposition  29 
it  suffices  to  show  that  all  priors  satisfy  REF.  This  is  indeed  the  case  if  /  7^  cx).  For  suppose 
that  R  E  A  C  TV .  We  want  to  show  that  Pl(p^p(A)  >  T.  Recall  that  V^i  p  =  ©mXpIp.  From 
the  dehnition  of  ©,  it  easily  follows  that  if  Pl(^  p(A  fl  R})  >  T,  then  Pl^^*  p(A)  >  T.  By 
dehnition,  we  have  that  Pl^^i  p(A  fl  7?.^)  =  Plp77)(A'),  where  A'  =  {{s,l)  :  E  A}.  Clearly 
(r, /)  G  A',  since  {r\m)  E  A.  Since  X  satishes  REF,  we  must  have  that  Plp77)(A')  >  T.  It 
follows  that  Plpip)  satishes  REF  ii  I  R  00.  This  argument  breaks  down  ii  I  =  00.  Indeed,  it 
is  clear  that  p  does  not  satisfy  REF.  Since  R’^  is  disjoint  from  R"^  for  m  <  00,  and  we 
only  “sum”  Xplp  for  m  <  cx)  to  obtain  p,  it  follows  that  R°°  is  disjoint  from  IU(^cx>  p,  so 
REF  does  not  hold. 

Fortunately,  a  slight  modihcation  of  the  construction  of  X'  can  be  used  to  deal  with  the  case 
REF  G  A.  Dehne  X^^p  =  (i?“p,Pl“p),  where  i?“p  =  {r°°}  and  Pl“p({r°°})  >  T.  Modify 
the  construction  of  X'  so  that  the  prior  of  agent  i  in  run  R  is  p  =  p  ©  V^i  -y  (Thus, 
p  =  ©m<ooX™i  p.)  It  is  easy  to  check  that  X'  now  does  satisfy  REF.  The  argument  in  the 
case  that  I  R  00  remains  unchanged.  On  the  other  hand,  if  G  A  C  X',  it  is  immediate 
that  V°°{A  n  R°°)  >  T,  so  we  can  now  deal  with  this  case  as  well.  If  QUAL,  RANK,  or 
NORM  is  in  A,  it  is  easy  to  see  (using  the  same  argument  as  above)  that  X'  also  satishes 
QUAL,  RANK,  or  NORM. 

It  remains  to  show  that  this  modihcation  of  the  prior  does  not  ahect  the  evaluation  of 
formulas.  That  is,  we  must  show  that  (X,  r,  m)  |=  0  if  and  only  if  {X',R,m)  \=  R  for  all 
I  >  m.  Again,  we  proceed  by  induction  on  the  structure  of  formulas.  The  argument  for 
formulas  of  the  form  KiR  goes  through  unchanged,  since  the  changes  to  Ph  did  not  ahect 
the  /Cj  relations.  The  argument  for  formulas  of  the  form  R  R  goes  through  with  almost 
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no  change.  The  only  case  that  requires  attention  is  if  \=  0  — >•*  0  and  [0](r,m,i)  =  T. 

Our  earlier  arguments  showed  that  Pl(r,j)((’^([0](r,m,i))^'  0  'JZ(W(^r,i',i))y')  =  T  for  all  /'  >  m, 
I'  ^  oo.  These  arguments  go  through  without  change.  We  must  now  show  that  this  also  holds 
if  /'  =  cx).  But,  from  the  dehnition  of  Pl“,  we  get  that  Pl“,i)((‘^([0](r,m,i))°°  O  Tl°°)  =  T 
unless  G  This  implies  that  (r, m)  G  [0](r,m,i)-  But  this  cannot  happen, 

since  Pl(r,m,i)([0](r,m,i))  =  T  aud  X  satisfies  REF.  □ 


Theorem  34:  Let  A  be  a  subset  of  {QUAL,  NORM,  REF,  SDP,  UNIF,  RANK}  and  let  X 
be  a  coherent  synchronous  system  satisfying  perfect  recall,  CONS,  PERSIST,  and  A.  Then 
there  is  a  synchronous  system  X'  satisfying  perfect  recall,  PRIOR,  and  A,  and  a  mapping 
f  -.IZ  ^  IZ'  such  that  for  all  temporally  linear  formulas  0  G  ,  (X,  r,m)  |=  0  if  and  only 
if  1=  0. 


PROOF.  Suppose  that  X  =  iJZ,  ti,Vi,  ...  ,Vn)  is  a  coherent  synchronous  system  satisfy¬ 
ing  perfect  recall,  CONS,  PERSIST,  and  A.  If  neither  CONS  nor  UNIF  are  in  A,  then 
Theorem  32  guarantees  that  there  is  a  system  X'  that  satisfies  the  stated  properties. 

Suppose  that  UNIF  G  A,  but  SDP,  REF  0  A.  (We  sketch  the  modihcations  required  to 
deal  with  SDP  and  REF  below.)  It  does  not  follow  that  the  system  X'  constructed  in  the 
proof  satisfies  UNIF.  To  see  why,  suppose  r,  r'  and  m>  k  are  such  that  (r',  k)  G  IU(r,fc,i)  but 
(r, m)  {r-',m).  UNIF  implies  that  Vi{r,k)  =  Vi{r',k)  and  (since  X  also  satishes  CONS) 
that  W(^r,m,i)OW(^r',m,i)  =  0-  Heuce,  our  construction  guarantees  that  V^k  p  7^  X’(0/fc  p,  although 
G  W^^k  p-  Thus,  the  prior  in  X'  does  not  satisfy  UNIF.  It  follows  that  X'  does  not  satisfy 
UNIF  either,  for  V}{r’^,  k)  7^  Vlir”^,  k),  although  (r'^,  k)  G  W'^^k 

The  solution  to  this  problem  is  relatively  straightforward.  We  modify  our  construction  so 
that  the  prior  does  indeed  satisfy  UNIF.  In  particular,  we  modify  the  prior  V'  to  ensure  that 
if  Vi{r,  k)  =  Viij-' ,  k),  then  V^k  p  =  Vy,k  Of  course,  we  have  to  do  so  carefully,  so  as  to 
make  sure  that  nothing  goes  wrong  with  the  rest  of  the  argument  in  Theorem  32. 

We  start  with  a  modihcation  of  the  construction  of  ©  that  takes  sets  (rather  than  sequences) 
of  plausibility  spaces  and  returns  a  new  plausibility  space. 

Lemma  36  Let  S  be  a  set  of  plausibility  spaces  such  that  the  sets  {W  :  (W,  PI)  G  5}  are 
pairwise  disjoint.  Then  there  is  a  plausibility  space  ©iS  such  that 

(a)  if  S  =  (W,  PI)  G  S,  then  ©5|vc  is  isomorphic  to  S  under  the  identity  mapping, 

(b)  if  S  is  gualitative  for  all  S  E  S,  then  ®S  is  gualitative, 

(c)  if  S  is  ranked  for  all  S  E  S,  then  ©iS  is  ranked. 
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PROOF.  Without  loss  of  generality  there  is  an  ordinal  A  and  a  sequence  {Si  :  0  <  i  <  \} 
such  that  Si  E  S  for  all  i,  and  for  all  S  E  S,  exists  an  i  such  that  S  =  SiS'^  Dehne 
=  (BiSi-  Part  (a)  of  Lemma  35  guarantees  that  is  a  plausibility  space.  Parts  (a),  (b), 
and  (c)  follow  immediately  from  parts  (e),  (b),  and  (c)  of  Lemma  35,  respectively.  □ 


Recall  that  to  satisfy  UNIF  and  PRIOR,  it  suffices  to  hnd  a  partition  of  R  such  that  all 
the  runs  in  each  cell  have  the  same  prior.  We  now  examine  a  possible  way  of  partitioning 
the  runs  in  the  system.  Let  r  E  R.  Define  [r,m]i  =  {(r',m)  :  {r',m)  {r,m),Vi{r' ,m)  = 

Vi{r,  m)}.  Thus,  [r,  m]i  is  the  set  of  points  in  which  agent  i  has  the  same  knowledge  state  and 
plausibility  assessment  as  at  {r,m).  (Note  that  if  W(^r,m,i)  7^  0,  then  since  X  satishes  CONS, 
Vi{r',m)  =  Vi{r,m)  implies  that  {r',m)  {r,m).) 

Lemma  37(a)  For  all  times  m,  the  collection  {7l{[r,m]i)  :  r  E  TZ]  is  a  partition  ofTZ. 

(b)  For  all  times  m  and  runs  r,  W(^r,m,i)  X  [r,  m]*. 

(c)  For  all  times  m  and  runs  r,  7l{[r,m  +  1]*)  C  7l([r,m]i). 

(d)  For  all  times  m  and  runs  r,r'  such  that  (r',  0)  G  [r,  0]*,  if  {r',m)  {r,m),  then  {r',m)  E 

[r,  m]i. 


PROOF.  By  dehnition,  if  (r',  m)  E  [r,m]i,  then  [r',m]  =  [r,m]i.  Thus,  if  [r,m]i  ^  [r',m]i, 
then  [r,m]i  O  [r',m]i  =  0.  Part  (a)  follows  immediately.  For  part  (b),  suppose  that  {r',m)  E 
hF(r,m,i)-  Since  X  satishes  CONS,  we  have  that  {r',m)  {r,m).  Moreover,  since  X  satishes 

UNIF,  we  have  that  Vi{r',  m)  =  Vi{r,  m).  Thus,  (r',  m)  E  [r,  m]*.  We  conclude  that  W(r,m.,i)  X 
[r,  m]j,  as  desired.  For  part  (c),  suppose  that  (r',m  +  1)  G  [r,  m  +  l]j.  This  implies  that 
(r', m+ 1)  (r, m  +  1)  and  Vi{r-)m  +  l)  =  W(r, m  +  1).  Since  X satishes  perfect  recall,  we  get 

that  (r',  m)  (r,  m).  Moreover,  since  X  satishes  PERSIST,  we  get  that  X’i(r',  m)  =  ^(r,  m). 
We  conclude  that  {r',m)  E  [r, m]*.  Thus,  Tl{[r,m  +  1]*)  C  7^([r, m]i),  as  desired.  Finally,  we 
prove  part  (d)  by  induction  on  m.  When  m  =  0,  part  (d)  obviously  holds.  Suppose  that 
m  >  0,  (r',  0)  G  [r,  0]*,  and  {r',m)  {r,m).  Since  X  satishes  perfect  recall,  we  have  that 

(r',  m  —  1)  (r,  m  —  1).  Using  the  induction  hypothesis,  we  get  that  (r',  m  —  1)  G  [r,  m  —  1]. 

This  implies  that  Vi{r' ,m  —  l)  =  W(r,  m  —  1).  Using  PERSIST,  we  conclude  that  W(r',  m)  = 
Vi{r,m).  Thus,  (r',m)  G  [r,m]i,  as  desired.  □ 


Using  both  ©  and  ©,  we  now  construct  a  prior  over  TZ'  that  satishes  UNIF.  For  r  E  R,  let 
[r]i  abbreviate  TZ{[r,0]i).  Dehne  :  r'  E  [r]*},  where  =  (X™j),Pl™j)) 

is  the  prior  dehned  in  the  proof  of  Theorem  32  that  is  isomorphic  to  Vi{r,m)  under  the 


mapping  r 


if  X, 


(r'' 


[r  ,  m 
then  7Z 


We  must  show  that  RJ^i)  is  well  dehned;  that  is,  we  must  show  that 


if 


r  ,m)  E 


\r'h  m] 


Xp,i)  and  Xp,^i) 


tiicii  /V™,  is  disjoint  from  TZf),,  Note  that 
are  identical.  Using  part  (b)  of  Lemma  37  we  get  that  if  (r',  m)  ^  [r 


then 


m\ 


If  S  is  uncountable,  this  construction  may  require  the  axiom  of  choice.  There  is  a  variant  of  the 
construction  that  does  not  require  the  axiom  of  choice,  but  the  additional  complexities  involved  do 
not  seem  worth  the  trouble. 


then  7?.™,  j)  j)  =  0,  as  desired.  Thus,  Pj™,  is  indeed  well  dehned.  We  now  dehne  = 

®rnPp^^  as  the  prior  of  agent  i  in  run  rh 

We  claim  that  this  family  of  priors  satishes  UNIT.  Notice  that  hh(p  j)  =  Um,r'G[r]i’^p  *)•  If 
r'™  G  then,  by  dehnition,  r'  G  W(r,m,i)-  Using  parts  (a)  and  (b)  of  Lemma  37,  we  get 

that  r'  G  [r]j.  It  easily  follows  that  [r']j  =  [r]j,  so  indeed  the  construction  guarantees  that 
V'^^i  j),  as  desired.  Since  the  family  of  priors  satishes  UNIT,  so  does  T' . 

Let  (j)  G  and  I  >  m.  As  in  the  proof  of  Theorem  32,  we  now  proceed  by  induction  on 
the  structure  of  formulas  to  show  that  {I\r\m)  \=  0  if  and  only  if  {X,r,m)  \=  (f).  The  only 
difference  arises  in  dealing  with  the  -^i  modality. 


As  before,  parts  (d)  and  (f)  of  Lemma  35  imply  that  is  isomorphic  to 

®k>m  m))}-  Again,  we  consider  the  hrst  term  in  the  “sum”,  We 

want  to  show  that  P[p,k'(^'(P,m))  =  Pp,i)k'(/c'(rtm))-  Recall  that  P(™i)k'(/c'(r*,m))  is  the  hrst 
term  in  the  analogous  “sum”  in  the  proof  of  Theorem  32.  Thus,  even  though  we  are  using 
a  diherent  prior  from  that  of  the  proof  of  Theorem  32,  after  conditioning,  they  are  essen¬ 
tially  the  same.  By  Lemma  36,  we  have  that  P[pjk^.)  =  Thus,  it  suffices  to  show 

that  fl  IZ' {JC[{r\m))  =  Ppp  H  IZ' ,m).  The  inclusion  from  right  to  left  is 

immediate.  For  the  opposite  inclusion,  suppose  that  G  Upg[p,77p  n77'(/C'(r^,  m)).  Since 
s™  G  77'(/C'(r^,  m)),  we  must  have  (r,  m)  {s,m).  Since  s™  G  Ur'e[r]i'JZ'^,  there  must  also 
be  some  run  r'  G  [r]j  such  that  s  G  TZ^,  Since  s  G  7Z'^{r',  i),  we  have  that  (s,  m)  G  IU(r',m,i)- 
By  part  (b)  of  Lemma  37,  (s,m)  G  [r',m]j.  By  part  (c)  of  Lemma  37,  we  get  that  (s,  0)  G 
[r',0]i.  Since  (r',  0)  G  [r,  0]i,  it  immediately  follows  that  [r',0]i  =  [r,  0]*.  Hence,  (s,  0)  G  [r,  0]*. 
Now  by  part  (d)  of  Lemma  37,  we  get  that  (s,m)  G  [r,m]i.  Thus,  Vi{s,m)  =  Vi{r,m). 
Since  X  satisfies  UNIF  and  (s,m)  G  W(r',m,i),  h  follows  that  Vi{s,m)  =  Vi{r',m).  Hence, 
(s,  m)  G  W(^r,m,i)-  Finally,  we  can  conclude  that  s  G  TZ'^y,  as  desired.  Given  this  equivalence, 
we  can  deal  with  the  -^i  case  just  as  we  did  in  the  proof  of  Theorem  32. 


Finally,  we  need  to  ensure  that  X'  satishes  A.  The  proof  of  Theorem  32  shows  that  if  X 
satishes  NORM,  then  so  does  X'.  Using  parts  (b)  and  (c)  of  Lemma  36,  it  easily  follows  that 
if  X  satishes  QUAL  or  RANK,  then  so  does  X'. 


If  REF  and  UNIF  are  both  in  A  (but  SDP  is  not),  then  we  need  a  further  modihcation  of 
the  prior,  in  the  same  spirit  of  that  in  the  proof  of  Theorem  32.  Dehne  V^y  =  (k“,Pl[qk 
where  Pl|p.(0)  =  T  and  Pl|p.(A)  =  T  for  all  A  k  0-  We  now  take  the  prior  of  the  agent  to  be 
V”r‘  i)  —  'P{r‘  i)  ®  straightforward  to  show  that  the  resulting  system  satishes  REF 

and  the  requirements  of  the  theorem,  using  essentially  the  same  arguments  for  dealing  with 
REF  as  in  the  proof  of  Theorem  32. 


Finally,  suppose  SDP  G  A  but  REF  is  not.  Note  that,  since  CONS  and  SDP  imply  UNIF, 
X  satishes  UNIF,  so  we  can  assume  without  loss  of  generality  that  UNIF  is  also  in  A.  To 
get  X'  to  satisfy  SDP,  we  further  modify  V'  so  that  it  depends  only  on  the  agent,  and  not 
the  run.  Thus,  we  dehne  X™  =  :  r  G  77},  and  dehne  V'y.i  y  =  ®rn'Pr-  Clearly, 
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with  this  prior,  X'  satishes  SDP.  Again,  we  need  to  check  that  this  change  in  prior  does 
not  affect  the  rest  of  our  argument.  Once  more,  the  only  difficulty  comes  in  dealing  with 
the  — case.  Just  as  in  the  case  of  UNIF,  we  proceed  by  showing  that  = 

The  argument  is  actually  even  easier  than  that  for  UNIF:  We  show  that 
•)  n  IZ'  {K.^{r\m))  =  H  TZ' {IC[{r\  m) .  Again,  the  inclusion  from  right  to  left  is 

immediate.  For  the  opposite  inclusion,  suppose  that  s™'  G  p  fl  IZ' {JC[{r\m)).  Since 

s™  G  IZ' {JC[{r-\m)),  we  must  have  (r, m)  {s,m).  Since  s'"  G  Ur.'i?™,  p,  there  must  also  be 
some  run  r'  such  that  s  G  Thus,  (s,m)  G  W(r',m,i)-  Since  X  satishes  CONS,  we  have 

(s,  m)  {r',m).  It  follows  that  {r',m)  {r,m).  Since  X  satishes  SDP,  we  must  have  that 

IF(rpm,2)5  SO  ^s, G  IFp^mp)*  Therefore,  s  G  as  desired. 

The  modihcations  to  deal  with  the  case  where  both  SDP  and  REF  are  in  A  are  identical  to 
the  case  with  UNIF,  and  are  omitted  here.  □ 
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